FortiSASE Security Services (SSL Inspection, DNS, Antivirus, IPS, Application Control)
Domain 4: FortiSASE Security Services (SSL Inspection, DNS, Antivirus, IPS, Application Control)
This domain tests the security profiles that inspect traffic after it is allowed by policy: SSL inspection, DNS filter, antivirus, IPS, and application control. The exam focuses on what each control can see, when it is bypassed, and how profiles interact with encrypted traffic.
Core rules
- Profiles are attached to firewall/security policies. A profile that is not attached inspects nothing; a profile attached to a policy that does not match the user also inspects nothing.
- SSL inspection has two modes. Certificate inspection reads certificate metadata/SNI without decrypting. Deep inspection decrypts and re-encrypts, which enables URL paths, file scanning, and many application signatures. Deep inspection requires the FortiSASE CA certificate to be trusted on endpoints and should have exclusions for privacy, legal, or pinned applications.
- DNS filter uses FortiGuard categories and botnet/C&C lists. It can block before a connection is established; DNS over HTTPS can bypass traditional DNS filtering unless the client or browser is controlled.
- Antivirus scans files and protocols. Encrypted downloads need deep inspection; large files and unsupported protocols may be bypassed by scan limits.
- IPS uses signatures and anomaly rules; actions are typically block or monitor. Application control identifies applications by signature and category, with per-application overrides.
- Application control and web filtering overlap but are not the same: web filtering classifies destinations/URLs; application control classifies the application behavior, including evasive or non-web protocols.
Worked example
A remote workforce must be protected from malicious downloads without breaking online banking. The administrator enables deep inspection in the internet policy, excludes the finance and healthcare categories from decryption, enables antivirus with block, IPS with block for critical signatures, application control blocking P2P, and DNS filter blocking botnet. A user downloads a malicious executable over HTTPS: deep inspection exposes the file, antivirus blocks it, and the log shows the file name. A banking session is certificate-inspected only and still works.
Reasoning: deep inspection is what gives antivirus and URL visibility into HTTPS; the exclusion preserves compatibility and privacy; each profile covers a different layer.
Traps
- Enabling antivirus but not deep inspection, then expecting HTTPS file scanning.
- Deploying deep inspection without distributing the CA certificate, causing certificate errors.
- Setting IPS to monitor and calling it protection.
- Using application control to block a website category, or web filtering to block a non-web protocol.
- Over-broad SSL exclusions that create a bypass for malware.
Key points
- Profiles only act when attached to a matching security policy.
- Certificate inspection does not decrypt; deep inspection is required for file and path visibility.
- Deep inspection needs the FortiSASE CA certificate trusted on endpoints.
- DNS filtering can stop botnet and category traffic before a connection is made.
- IPS, antivirus, and application control cover different layers and must be enabled together.