Simple definition
Flow-based Inspection is a FortiGate mode that inspects traffic as a session passes through the firewall without systematically rebuilding it as a full proxy session.
Technical definition
The engine analyzes packets and session streams to apply compatible security profiles, with processing designed for high throughput and low latency compared with full proxy inspection.
What is it used for?
Apply controls such as IPS, antivirus, or filtering on policies where performance and latency matter.
Practical example
An Internet policy can use security profiles in flow mode to inspect user sessions while maintaining high throughput.
Common issues
- A required profile or feature needs a different inspection mode
- Behavior changes after switching between flow-based and proxy-based inspection
- Hardware offload or policy configuration makes troubleshooting more difficult
How it works / role
When a session matches the policy, FortiGate identifies it and passes packets and stream data to the enabled security engines. Their verdicts are enforced while traffic is flowing, without FortiGate acting as a full application proxy for the entire session.
Related terms
Proxy-based Inspection · FortiGate · IPS
Key takeaway: Exact behavior can vary by version, product, and architecture; always validate on the environment actually deployed.