Description
This article describes how to change the inspection mode of the firewall. The FortiGate firewall can operate in two different modes: flow mode and proxy mode.
Proxy-based: the proxy-based inspection involves buffering traffic and examining it as a whole before determining an action.
The process of having the whole of the data to analyze allows for the examination of more data points than the flow-based.
Flow-based: the flow-based inspection method examines the data packets as they pass through the FortiGate without any buffering.
Each packet that arrives is processed and forwarded without waiting for the complete file or web page.
Solution
FortiOS 6.0.
From GUI.
To control the FortiGate's security profile inspection mode in FortiOS, select 'Flow-based' or 'Proxy-based' modes from System -> Settings.
From CLI.
Use the below command to change the inspection mode:
Use the below command to change the inspection mode:
config system settings
set inspection-mode <flow or proxy>
end
FortiOS 6.2 to 7.0.x.
From GUI.
To control the FortiGate's security profile inspection mode per policy, select 'Flow-based' or 'Proxy-based' modes from IPv4 Policy -> Edit (a particular policy).
From the CLI.
Use the below command to change the inspection mode:
config firewall policy
edit # (ID of the policy)
set inspection-mode <flow or proxy>
end
FortiOS 7.2.4+.
After upgrading Firmware 7.2.4, some devices cannot see inspection mode on GUI.
By default, the inspection mode of the new firewall policy is set to Flow Based.
If it is wanted to move inspection mode to proxy-based, use the below commands:
From CLI.
Use the below command to change the inspection mode to proxy mode:
config firewall policy
edit <firewall policy ID>
set inspection-mode proxy
end
Once these changes are performed, the inspection mode in GUI will be shown:
This is an expected behavior, and this feature is placed for a reason.
It is possible to review this document for the new feature enhancement of 7.2.4:
Note.
When the firewall is running in NGFW policy-based mode, the operational mode is limited to 'flow', with no possible option to change to 'proxy'.
Related document:
