Inspection mode: flow vs proxy
flow-based · proxy-based
how the FortiGate buffers and scans traffic for a security profile — packet-by-packet, or by reconstructing the whole object first
Set per firewall policy in FortiOS 7.x. It decides how content inspection sees the traffic.
The exam wants you to know: proxy catches more but costs more and can break things; flow is the default and the lighter touch. Some features (e.g. certain DLP, some web-filter options, external resource blocking) only exist in one mode.
How it is read
Flow-based
mode
Scans packets as they pass, using an IPS engine that assembles just enough to match signatures. Lower latency, higher throughput, no proxy-induced connection changes. The default. Weaker on things that need the full object (e.g. some file-type / archive handling), and it fails open-ish under load — a session in conserve mode may pass without full scanning.
Proxy-based
mode
The FortiGate terminates the client connection, pulls the entire object (web page, file, email), scans it fully, then opens a second connection to the server. Catches more (full antivirus, better web filtering, safe-search enforcement, block-page replacement). Costs memory and latency, adds a hop that can trip up apps expecting a direct connection, and is the first thing to shed load in conserve mode.