FortiOS 6.2 inspection mode change (Flow/Proxy)

FortiOS has implemented an improvement in version 6.2 that provides greater traffic control flexibility by combining control in Proxy mode and Flow mode simultaneously with Firewall or VDOM.

To remember the differences between proxy mode and Flow mode

      Flow Mode

• It is the default inspection mode and is fast.
• It keeps the client-to-server TCP session intact.

Proxy Mode

• The TCP connection is split into two parts.
• Allows Full Buffering (Allows certain audit functions like DLP mode, ICAP, SSH Audit as well as some extra features like Safe Search, Java/ActiveX/Cookies, Quotas in WebFilter mode, etc.)
• In previous versions of FOS (from 5.4 to 6.0) all policies of the same VDOM had to follow the same inspection mode (Flow Mode or Proxy mode)
• As of FOS 6.2, the possibility to combine audit policies in Proxy mode with others in Flow Mode simultaneously in the same VDOM has been implemented.

Note: The selection of Inspection mode is made in each policy.

In the image below you can see some kind of policy where the new option has been added to configure the Inspection mode.

The following command was enabled by the CLI to configure the control within the policy:

config firewall policy

(policy) # edit 0

(2) # set inspection-mode ?

proxy > Proxy based inspection.

flow > Flow based inspection.

config firewall policy

edit 0

set name "Allow_All"

set srcintf "port2"

set dstintf "port1"

set srcaddr "all"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

set utm-status enable

set inspection-mode proxy

set av-profile "default"

set ssl-ssh-profile "certificate-inspection"

set nat enable

next

end