Advanced Security Profiles and Content Inspection
Advanced Security Profiles and Content Inspection tests how you combine FortiGuard profiles on a firewall policy, choose flow or proxy inspection, and deploy TLS inspection without breaking applications.
Core rules
- Security profiles attach to a firewall policy and run after the policy matches. The profile set, not the policy name, determines whether AV, IPS, web filtering, application control, DNS filtering, email filtering, DLP or file filtering act on the traffic.
- Flow-based inspection is the scalable default. Proxy-based inspection enables deeper protocol and content handling for specific needs, but costs performance and can alter application behaviour.
- Certificate inspection reads the server certificate and SNI without decrypting. Deep inspection decrypts, inspects and re-signs with the FortiGate CA, so clients must trust that CA.
- Exemptions are part of the design: certificate-pinned applications, financial or legal traffic, and private-key traffic may need deep-inspection bypass. Exempt by destination or category, not by disabling inspection globally.
- Protocol options control ports, comfort clients, oversized files and blocked MIME types. A profile cannot inspect what the protocol handler discards or what exceeds configured limits.
Worked example
Users need HTTPS inspection, but a line-of-business SaaS application uses certificate pinning. Enable deep inspection on the general outbound policy with web filtering, AV and IPS. Add a deep-inspection exemption for the SaaS destination and keep certificate inspection plus application control for it. Distribute the FortiGate CA certificate to managed endpoints through a configuration profile. Test the pinned app after the change; if it still fails, verify the exemption is matching before the policy's deep-inspection profile is applied.
Traps
- Turning on deep inspection for all destinations and breaking pinned or mutual-TLS apps.
- Forgetting to distribute the inspection CA to clients.
- Expecting flow mode to inspect archives or protocols that require proxy handling.
- Relying on AV for files above the oversize limit without logging the bypass.
- Stacking every profile without checking CPU, memory and session capacity.