Offline Protection mode

Offline Protection Mode is a deployment method where FortiWeb monitors network traffic passively without being directly in the data path. Instead of processing live traffic, it receives a mirrored copy of requests and responses via a SPAN (Switched Port Analyzer) or mirroring port on a network switch. This allows FortiWeb to inspect traffic for threats without altering or delaying the flow of data to your web servers.

However, a key disadvantage of Offline Protection Mode is that it cannot block attacks in real time. While FortiWeb can detect malicious traffic and send a TCP RST (reset) packet to terminate the connection, this response is often delayed. Since the attack request has already been forwarded to the server before FortiWeb can react, the attack may still succeed before the reset takes effect. This delay reduces the effectiveness of attack mitigation, making Offline Protection Mode more suitable for monitoring and alerting rather than proactive threat prevention.