NGFW policy-based firewall policies might have unintended consequences to the passing or blocking of traffic. You can also backup your configuration before switching modes. If you don’t want this to happen or you just want to experiment with policy-based NGFW mode, consider creating a new VDOM for policy-based NGFW mode. Switching NGFW mode from profile-based to policy-based converts your profile-based security policies to policy-based security policies. This means users can operate their FortiGate or individual VDOMs on their FortiGate in NGFW policy-based mode when they select flow-based inspection. If a URL category is set, the applications that are added to the policy must be within the browser-based technology category. In this mode, users can add applications and web filtering categories directly to a policy without having to first create and configure Application Control or Web Filtering profiles.

Profile-based NGFW is the traditional mode where a user needs to create an AV/web/IPS profile which is applied to the policy. This model is divided into two working modes - profile-based and policybased.

This mode is only available when the VDOM inspection-mode is flow. From version 5.6, we added a new policy mode called Next Generation Firewall (NGFW).

Fortinet ngfw