A utility network architect is choosing an inspection mode for a high-throughput fiber link between two substations that mostly carries routine telemetry and management traffic, where CPU and memory headroom on the FortiGate are limited and full-object buffering is not a priority. Which mode best fits this constraint?
Select an answer to reveal the explanation.
Short Explanation
When headroom is tight, you want the lighter-weight option, and flow-based inspection is built for exactly that. It streams packets through the IPS engine instead of reconstructing whole objects, which costs less CPU and memory. For a busy substation link with routine traffic and no pressing need for full buffering, that trade-off fits perfectly.
Full Explanation
Flow-based inspection's single-pass, streaming architecture generally consumes less CPU and memory than proxy-based inspection's approach of reconstructing complete objects before making a decision, which makes it the better fit when a FortiGate has limited resource headroom and the traffic in question doesn't demand the richest possible content handling. That resource trade-off is the core reason flow-based mode is FortiOS's default for most policies. The claim that proxy-based inspection always outperforms flow-based regardless of constraints gets the trade-off backwards — proxy-based buffering typically costs more resources precisely because it holds full objects, which is the opposite of what a constrained device needs. Deep inspection and certificate inspection are not alternatives to flow-based and proxy-based inspection mode at all; they are SSL/SSH inspection profile settings that determine how encrypted traffic is handled and can be layered on top of either flow-based or proxy-based policies, so treating deep inspection as a competing 'inspection mode' in this list confuses two separate configuration axes. Certificate inspection is likewise not defined by hardware suitability; it is a shallower SSL-visibility choice, not a resource-optimization feature. To validate the decision, monitor the FortiGate's CPU and session-table utilization on that substation link after applying flow-based inspection and compare it against the same traffic mix under proxy-based inspection in a lab if headroom is a serious concern.