A network engineer is designing the firewall policy for the link between a remote substation and the utility's NOC, where throughput and low latency matter more than the richest possible content-inspection feature set. The engineer selects flow-based inspection for that policy. What is the main architectural reason flow-based inspection fits this requirement?

Flow-based inspection is FortiOS's single-pass content-inspection architecture: security profiles (antivirus, web filtering, application control, and IPS) are evaluated together using the IPS engine as traffic streams through the device, rather than each profile reconstructing and re-examining the object independently. That design keeps CPU and memory overhead lower and latency shorter, which is exactly the trade-off a substation-to-NOC link with tight throughput requirements wants. It does not decrypt TLS by default — SSL inspection is a separate setting layered on top of whichever inspection mode is chosen, and flow-based policies can run without any decryption at all. It also does not disable security profiles; profiles still apply, just through the streaming engine rather than a buffering proxy, so the substation link still gets meaningful protection. Nor does it require an external proxy appliance — proxy-based inspection uses an internal proxy process on the FortiGate itself, not a separate box. When validating the choice, confirm the policy's inspection mode in its configuration and watch session and CPU counters on that link to see the expected reduction in processing overhead compared to a proxy-based policy carrying the same profiles.