Security Profiles and Content Inspection
Core concepts
Security profiles attach to firewall policies and inspect allowed traffic: antivirus, IPS, web filter, application control, DNS filter, email filter, and SSL inspection. Profiles are applied in a profile group or individually. Order and mode matter: proxy-based vs flow-based inspection changes which features are available and how traffic is handled. IPS signatures, antivirus databases, and web-filter categories require updated FortiGuard definitions.
SSL inspection
Certificate inspection (no decryption) versus deep inspection (decryption with a re-signed certificate) is a classic exam distinction. Deep inspection requires the client to trust the FortiGate's CA certificate; otherwise users see certificate warnings. Questions often ask why a site breaks under deep inspection-pinned certificates or unsupported ciphers are typical answers.
Traps to watch
- A profile only inspects traffic the policy allows; a permissive policy with no profiles provides no content security.
- Profile mode (proxy vs flow) limits some features; for example, certain antivirus or web-filter options behave differently.
- SSL exemptions can bypass inspection for selected destinations-useful but a potential blind spot.
- Application control can identify and block apps even on nonstandard ports, unlike service-based policy matching.
Worked example
A policy allows outbound web traffic with a web filter in block mode for a category. A user reports a site loading. Check: Is the policy matched? Is SSL deep inspection enabled so the category can be evaluated for HTTPS? Is the category correctly classified? Is there an exemption? Each layer can explain the observed behavior. Rule of thumb: allow + inspect, never allow without inspection for untrusted traffic.