Inspection mode differences for Email Filter

This section identifies the behavioral differences between Email Filter operating in flow and proxy inspection.

Feature comparison between Email Filter inspection modes

The following table indicates which Email Filters are supported by their designated inspection modes.

Feature comparison between Email Filter inspection modes

The following tables indicate which Email Filters are supported by the specified inspection modes for local filtering and FortiGuard-assisted filtering.

Inspection mode differences for Data Leak Prevention

This section identifies the behavioral differences between Data Leak Prevention (DLP) operating in flow and proxy inspection.

Feature comparison between DLP inspection modes

The following table indicates which DLP filters are supported by their designated inspection modes.

*File-size filtering will only work if file size is present in the protocol exchange.

Protocol comparison between DLP inspection modes

The following table indicates which protocols can be inspected by DLP based on the specified inspection modes.

Inspection mode differences for Antivirus

This section identifies the behavioral differences between Antivirus operating in flow and proxy inspection.

Feature comparison between Antivirus inspection modes

The following table indicates which Antivirus features are supported by their designated scan modes.

*IPS Engine caches the URL and a replacement message will be presented after the second attempt.

1. Only available on FortiGate models with HDD or when FortiAnalyzer or FortiCloud is connected and enabled.
2. Only applies to inspection on IMAP, POP3, SMTP, and MAPI protocols.

Protocol comparison between Antivirus inspection modes

The following table indicates which protocols can be inspected by the designated Antivirus scan modes.

* Proxy mode Antivirus inspection on CIFS protocol has the following limitations:

• Cannot detect infections within archive files l Cannot detect oversized files
• Will block special archive types by default l IPv6 is not supported yet (at the time of FOS v6.2.0 GA)

Other Antivirus differences between inspection modes

Flow Quick mode uses a separate pre-filtering database for malware detection as opposed to the full AV signature database that Flow Full and Proxy mode inspection use.

Proxy mode uses pre-scanning and stream-based scanning for HTTP traffic. This allows archive files that exceed the oversize limit to be uncompressed and scanned for infections.

Inspection mode feature comparison

The following table shows which UTM profile can be configured on a flow mode or proxy mode inspection policy. Remember that some UTM profiles are hidden in the GUI, but can be configured by using the FortiOS CLI.

1. CIFS inspection cannot be configured via GUI.
2. Some Antivirus features are not supported in flow mode inspection. See Inspection mode differences for Antivirus on page 401.
3. Some Data Leak Prevention features are not supported in Flow mode inspection. See Inspection mode differences for Data Leak Prevention on page 402.
4. Some Email filter features are not supported in Flow mode inspection. See Inspection mode differences for Email Filter on page 402.
5. Some Web filter features are not supported in Flow mode inspection. See Inspection mode differences for Web Filter on page 403.

Proxy mode inspection

When a firewall policy’s inspection mode is set to proxy, traffic flowing through the policy will be buffered by the

FortiGate for inspection. This means that the packets for a file, email message, or web page will be held by the FortiGate until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS has finished the inspection, the payload is either released to the destination (if traffic is clean) or dropped and replaced with a replacement message (if traffic contains violations).

To optimize inspection, the policy can be configured to block or ignore files or messages that exceed a certain size. To prevent the receiving end user from timing out, client comforting can be applied, which allows small portions of the payload to be sent while it is undergoing inspection.

Proxy mode provides the most thorough inspection of the traffic; however, its thoroughness sacrifices performance, making its throughput slower than that of a flow-mode policy. Under normal traffic circumstances, the throughput difference between a proxy-based and flow-based policy is not significant.

Flow mode inspection (default mode)

When a firewall policy’s inspection mode is set to flow, traffic flowing through the policy will not be buffered by the FortiGate. Unlike proxy mode, the content payload passing through the policy will be inspected on a packet by packet basis with the very last packet held by the FortiGate until the scan returns a verdict. If a violation is detected in the traffic, a reset packet is issued to the receiver, which terminates the connection, and prevents the payload from being sent successfully.

Because of this method, flow mode inspection cannot be as thorough as proxy mode inspection and will have some feature limitations. For example, flow mode inspection determines a file’s size by identifying the file size information in the protocol exchange. If a file’s size is not present in the protocol exchange, the file’s size cannot be identified. The flow-based policy will automatically block or pass the file (based on the configuration) despite the file meeting the file size requirements.

The objective of flow-based policy is to optimize performance and increase throughput. Although it is not as thorough as a proxy-based policy, flow mode inspection is still very reliable.