Inspection modes
FortiOS supports flow-based and proxy-based inspection in firewall policies. You can select the inspection mode when configuring a policy.
Flow-based inspection takes a snapshot of content packets and uses pattern matching to identify security threats in the content.
Proxy-based inspection reconstructs content that passes through the FortiGate and inspects the content for security threats.
Certain security profiles allows users to display flow-based or proxy-based feature sets.
Certain unused WAD proxy processes are not started by default on FortiGate models with 2 GB of RAM or less to reduce memory usage. These process will only start when relevant proxy features are configured, such as explicit proxies, transparent proxies, or ZTNA.
This following topics provide information about inspection modes for various security profile features: