Changing modes
You can see which inspection mode your FortiGate is using by looking at the System Information widget on your Dashboard.
To change inspection modes, go to System > Settings and scroll down to Inspection Mode. You can select Flow-based to operate in Flow mode or Proxy to operate in Proxy mode.
When you select Flow-based, all proxy mode profiles are converted to flow mode, removing any proxy settings. As well proxy mode only features (for example, Web Application Profile) are removed from the GUI.
In addition, selecting Flow-based inspection will cause the Explicit Web Proxy and Explicit FTP Proxy features to be removed from the GUI and the CLI. This includes Explicit Proxy firewall policies.
When you select Flow-based you can only configure Virtual Servers (under Policy & Objects > Virtual Servers) with Type set to HTTP, TCP, UDP, or IP.
If required, you can change back to proxy mode through the System > Settings page.
If your FortiGate has multiple VDOMs, you can set the inspection mode independently for each VDOM. Use the top left drop-down menu to go to Global > System > VDOM. Click Edit for the VDOM you wish to change and select the Inspection Mode.
|
|
Switching to flow-based inspection also turns off WAN Optimization, Web Caching, the Explicit Web Proxy, and the Explicit FTP Proxy making sure that no proxying can occur. |
From the GUI, you can only configure antivirus and web filter security profiles in proxy mode. From the CLI you can configure flow-based antivirus profiles, web filter profiles and DLP profiles and they will appear on the GUI and include their inspection mode setting. Also, flow-based profiles created when in flow mode are still available when you switch to proxy mode.
NGFW profile-based and NGFW policy-based modes
When you select Flow-based as the Inspection Mode, you have the option in FortiOS to select an NGFW Mode. NGFW Profile-based mode works the same as flow-based mode did in FortiOS 5.4
When selecting NGFW policy-based mode you can also select the SSL/SSH Inspection mode that is applied to all policies.
In the new NGFW Policy-based mode, you add applications and web filtering profiles directly to a policy without having to first create and configure Application Control or Web Filtering profiles.
When you change to flow-based inspection, all proxy mode profiles are converted to flow mode, removing any proxy settings. And proxy-mode only features (for example, Web Application Profile) are removed from the GUI.
If your FortiGate has multiple VDOMs, you can set the inspection mode independently for each VDOM. Go to System > VDOM. Click Edit for the VDOM you wish to change and select the Inspection Mode.
CLI syntax
The following CLI commands can be used to configure inspection and NGFW (called "policy" in the CLI) modes:
config system settings
set inspection-mode {proxy | flow}
set policy-mode {standard | ngfw}
end