What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

FortiOS offers two Next-Generation Firewall (NGFW) modes: profile-based and policy-based. When configured in policy-based NGFW mode, FortiGate integrates application control and web filtering directly into the firewall policy. This mode is designed for simplicity and performance and exclusively uses the flow-based inspection engine. Flow-based inspection analyzes packets as they pass through the FortiGate, providing good performance with low latency, which is a key characteristic of this NGFW mode.

A. Full Content inspection: This is a descriptive term, not an official FortiOS inspection mode. Both flow-based and proxy-based modes perform content inspection.

B. Proxy-based inspection: This mode is available in profile-based NGFW mode but is not used in policy-based NGFW mode, which relies solely on flow-based inspection.

C. Certificate inspection: This is a specific inspection type used for SSL/TLS traffic within either flow-based or proxy-based modes, not a standalone firewall inspection mode.

Fortinet FortiOS 7.0.0 Administration Guide, "NGFW Mode" section, p. 838. It explicitly states, "In policy-based NGFW mode, FortiOS uses flow-based inspection and the security profiles functionality is limited."

Fortinet FortiOS 7.0.0 Security Profiles Guide, "Inspection modes" section, p. 10. This guide details the differences between flow-based and proxy-based inspection, clarifying their use cases and association with NGFW modes.