Inspection Mode Per Policy

In this version, in NGFW Mode, the Inspection Mode is moved to per-policy, enabling more flexible setup for different policies.

In System > VDOM, the NGFW Mode option has been removed.

When you configure a policy, you can select a Flow-based or Proxy-based Inspection Mode. Default is Flow-based.

If you change to Proxy-based, the Proxy HTTP(S) traffic option displays.

In the Security Profiles section, if no security profiles are enabled, the default SSL Inspection is no-inspection.

In the Security Profiles section, if you enable any security profile, the SSL Inspection changes to certificate-inspection.

To see the inspection mode changes in the CLI:

FortiGate-101E (root) # config firewall policy

FortiGate-101E (policy) # edit 1

FortiGate-101E (1) # set utm-status disable

FortiGate-101E (1) # set inspection-mode
proxy    Proxy based inspection.
flow     Flow based inspection.

FortiGate-101E (1) # set inspection-mode proxy

FortiGate-101E (1) # end

FortiGate-101E (root) # sh firewall policy
config firewall policy
    edit 1
        set uuid 05d88354-4817-51e9-7494-06cb70accbf0
        set srcintf "wan2"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set inspection-mode proxy
        set nat enable
    next
end

To see http-policy-redirect/ssh-policy-redirect setting when inspection mode is set to proxy:

FortiGate-101E (root) # config firewall policy

FortiGate-101E (policy) # end

FortiGate-101E (root) # config firewall policy

FortiGate-101E (policy) # edit 1

FortiGate-101E (1) # set inspection-mode proxy

FortiGate-101E (1) # set http-policy-redirect
enable     Enable HTTP(S) policy redirect.
disable    Disable HTTP(S) policy redirect.

FortiGate-101E (1) # set ssh-policy-redirect
enable     Enable SSH policy redirect.
disable    Disable SSH policy redirect.

FortiGate-101E (1) # set http-policy-redirect enable

FortiGate-101E (1) # set ssh-policy-redirect enable

FortiGate-101E (1) # end

FortiGate-101E (root) # sh firewall policy 1
config firewall policy
    edit 1
        set uuid 05d88354-4817-51e9-7494-06cb70accbf0
        set srcintf "wan2"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set inspection-mode proxy
        set http-policy-redirect enable
        set ssh-policy-redirect enable
        set nat enable
    next
end

To see the default ssl-ssh-policy set to no inspection:

FortiGate-101E (root) # config firewall policy

FortiGate-101E (policy) # edit 1

FortiGate-101E (1) # sh
config firewall policy
    edit 1
        set uuid 05d88354-4817-51e9-7494-06cb70accbf0
        set srcintf "wan2"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set inspection-mode proxy
        set http-policy-redirect enable
        set ssh-policy-redirect enable
        set nat enable
    next
end

FortiGate-101E (1) # sh fu | grep ssl-ssh-profile
        set ssl-ssh-profile "no-inspection"

FortiGate-101E (1) # end