I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6: Security Profiles

FCSS Enterprise Firewall 7.6 · Work through your exam, one topic at a time.

All guide sections

Security Profiles

Security Profiles

Security Profiles tests your ability to attach UTM inspection to a policy and predict what actually gets inspected. Expect questions about which profile handles which threat, flow versus proxy inspection, SSL inspection depth, and the practical limits of inspecting HTTPS without breaking users.

Core rules

  • Binding. A policy needs set utm-status enable plus the specific profiles: av-profile, ips-sensor, webfilter-profile, application-list, dnsfilter-profile, file-filter-profile, dlp-sensor and ssl-ssh-profile. Profiles can be bundled into a profile group.
  • Flow versus proxy. Set per VDOM (config system settings, set inspection-mode) and overridable per policy. Flow is the default and the fastest; proxy buffers traffic and is needed for features such as full email filtering, some DLP modes and content disarm.
  • SSL inspection. In ssl-ssh-profile, entries are no-inspection, certificate-inspection (reads the server certificate and SNI without decrypting) or inspect (deep inspection, man-in-the-middle). Deep inspection requires clients to trust the FortiGate CA certificate; otherwise users see certificate warnings and pinned applications break.
  • What each profile does. Antivirus scans files and streams; IPS matches signatures and can block malicious URLs, and doubles as virtual patching for known CVEs; web filter applies FortiGuard categories plus static URL filters; application control identifies applications regardless of port; DNS filter blocks botnet C&C domains.
  • Actions. Every profile distinguishes monitor (log only) from block. IPS sensor entries can be filtered by severity or category and overridden per signature.

Worked example

A guest Wi-Fi policy uses a web filter blocking malware and proxy categories, application control blocking P2P, antivirus, IPS, and SSL inspection set to certificate-inspection only, because guests will not install a CA certificate. Reasoning: without decryption the FortiGate sees only the server certificate and SNI, so HTTPS category matching is coarse; adding DNS filter and application control keeps coverage reasonable without triggering browser warnings.

Traps

Setting utm-status but leaving the profile fields empty; enabling deep inspection and then chasing certificate errors for days; leaving IPS on monitor when the requirement is to block; an SSL exemption list that quietly bypasses inspection for the exact domain under test; assuming antivirus scans inside encrypted sessions without deep inspection.