Inspect Everything: Deep Inspection Brings a 100F to Its Knees
A head office runs a FortiGate 100F on FortiOS 7.2 with 1,500 users, a 1 Gbps internet circuit and 40 firewall policies. To close an audit finding, the team enabled a deep-inspection profile on all 40 policies six weeks ago and distributed the FortiGate CA certificate by Group Policy. Since then helpdesk tickets have tripled: Microsoft Teams calls drop, a SaaS ERP refuses logins, several banking portals and a medical imaging portal fail to load, and the firewall sits at 85 to 95 percent CPU during business hours with throughput around 250 Mbps. The auditor insists that all traffic must be inspected. The CISO wants to know whether a bigger FortiGate fixes it or whether the design is wrong. A FortiClient EMS instance is available for certificate deployment, and 200 servers never leave the datacentre.
1. Explain the root causes of the failing applications and of the CPU and throughput symptoms, separating the two problems.
Read the worked answer
There are two distinct failures here, and conflating them leads to the wrong fix.
The application failures are certificate-trust and protocol problems. Deep inspection terminates TLS and re-signs with the FortiGate CA, so any client that does not trust that CA breaks. Group Policy covers domain-joined desktops, but not the imaging portal workstation that is off-domain, not personal devices, and not applications that ship their own trust store. Applications that pin certificates will refuse the substituted certificate regardless of trust store, which is the common cause of the SaaS ERP and banking failures. Real-time media in Teams can also break because of pinning and added inspection latency, and because much of it prefers QUIC over UDP 443, which the FortiGate cannot decrypt; if QUIC is not blocked, the traffic bypasses inspection and may still behave unpredictably.
The performance symptom is sizing. Deep inspection is CPU-intensive, and inspected throughput on a 100F is a fraction of its firewall throughput. Pushing a 1 Gbps circuit's worth of TLS through one desktop-class appliance, with logging on 40 policies, lands exactly where the observed numbers do: roughly 250 Mbps and near-saturation CPU. Note too that 200 servers whose traffic never leaves the datacentre are being inspected for no benefit, adding load and breaking internal TLS names.
So the design is wrong twice: inspecting the wrong traffic, and inspecting more traffic than the platform can handle.
2. Design an inspection policy that satisfies the audit intent while being operable. Be specific about what is decrypted, what is only certificate-inspected, and how certificates reach endpoints.
Read the worked answer
Use a risk-based design with three tiers, and document each tier so the auditor sees intent rather than exceptions.
- Full inspection for the highest-value, lowest-friction traffic: uncategorised destinations, newly registered domains, file-sharing and download categories, and anything carrying executable or archive content. This is where inspection earns its CPU.
- Certificate inspection only, no decryption, for finance, health and legal categories, and for known pinned SaaS applications. These are the flows that break users and can create privacy and regulatory exposure; the connection is still validated against the certificate chain.
- No internet inspection for internal server-to-server traffic, which should be handled by internal segmentation policy rather than forced through an internet profile.
Mechanically: build the exemption list for pinned destinations and categories rather than carving out whole policies, keep one clear policy per tier so troubleshooting is possible, and block QUIC where the application can fall back to TCP so inspection actually applies. Deploy the FortiGate CA to every managed endpoint, including off-domain laptops, through FortiClient EMS and MDM rather than relying on Group Policy, and monitor for certificate warnings as a signal that a device is missing it.
Sizing is not optional. Compare the model's published inspected-throughput figure with the traffic you actually intend to decrypt, not with the circuit speed. If the inspected volume exceeds the platform, either reduce the inspected set to fit, upgrade the appliance, or split inspection across devices. A bigger box with the same all-traffic policy will simply fail later.
3. The auditor repeats that all traffic must be inspected. Draft the response to the auditor and the CISO, including what you would commit to and what compensating controls you would cite.
Read the worked answer
Frame the reply as risk management with evidence, not as refusal.
To the auditor: explain that decryption is a control, and the audit objective is visibility and prevention of threats in transit. Then show that the proposed design achieves the objective with measurable coverage: what percentage of traffic is decrypted, what is certificate-inspected, and why the excluded categories are excluded, including any legal or privacy restrictions on decrypting banking and health traffic. Offer a written exception register with an owner, a review date, and named compensating controls for each exception.
Compensating controls you can genuinely cite here: FortiEDR on endpoints to catch what network inspection misses, DNS and web filtering on all policies, sandboxing of downloaded files, segmentation to contain a compromised host, and logging plus alerting on the certificate-inspection-only flows.
To the CISO: state plainly that literal inspect-everything is achievable only with capacity you do not own today. Give two honest options with costs. Option one, reduce decrypted volume to what the 100F can handle and accept documented exceptions. Option two, fund an upgrade and staffing so inspected throughput matches the circuit, and accept that pinned applications will still break because no firewall can decrypt a pinned session. Recommend a 30-day pilot of the three-tier design with a before-and-after ticket count, CPU baseline and blocked-threat count, and commit to reporting whether the risk posture improved, which is the question the auditor actually cares about.