Flow-Based vs Proxy-Based Antivirus: Key Differences

Quick Answer

The answer is that proxy-based antivirus inspection reassembles the entire file before scanning, while flow-based antivirus scans the data as it passes through the FortiGate. This difference stems from how each method handles traffic: proxy-based inspection buffers the complete file in memory, allowing for deep, thorough detection of threats like packed malware or complex scripts, but at the cost of higher latency and resource consumption. In contrast, flow-based inspection leverages the FortiASIC hardware acceleration to scan packets on the fly, offering much lower latency and higher throughput, making it ideal for high-speed environments. On the Fortinet NSE 4 exam, this distinction tests your understanding of performance versus security trade-offs, often appearing in scenario-based questions where you must choose the appropriate inspection mode for a given network condition. A common trap is assuming flow-based is always better because it is faster; remember that proxy-based is required for features like file filtering and content disarm. For a quick memory tip, think of proxy as “pausing and peeking” at the whole file, while flow-based is “fast and fleeting.”