FortiGate Security Profiles — Flow vs Proxy, Web Filter, AppCtrl, IPS, AV in 11 Minutes

Why this matters — the airport-security analogy

Imagine the security stack at Mumbai T2. Every passenger walks the same line, but each layer of the check is doing something different. Boarding-pass scan asks "where are you going?" — that's your Web Filter. X-ray asks "what's in the bag?" — that's App Control. Behavior analyst watches gait and nervousness — that's IPS. Bomb-sniffing dog is the chemical signature check — that's AV. And when CISF wants to open the bag because something looks weird? That's deep-inspection — the firewall opens the TLS bag, inspects, and zips it back up before forwarding.

Now the catch. The airport runs two parallel security lines — one is fast (everyone walks through, scanners look for obvious things), the other is slow (full unpack, swab, behavioral profile). T2 calls them domestic vs international. FortiGate calls them flow-based vs proxy-based inspection. Same UTM tools — totally different depth and cost.

The 90-second mental model

Flow-based inspection reads the packet stream as it passes, pattern-matching in-line. It's fast (NPU-friendly, low memory) and good enough for IPS signatures, basic AV stream-scan, web filter URL lookup, and App Control. Proxy-based inspection buffers the entire object (a file, a full HTTP transaction) in FortiOS memory, reassembles it, scans the full reconstructed object, then forwards. Higher CPU + memory cost, but it's the only way to do full DLP pattern matching, sandbox handoff, and some advanced AV checks.

The interview line you need: "Flow is the default. Proxy is the exception. Pick proxy only when the profile literally cannot work in flow."

Three terms every interviewer will test

Flow-based mode reads the byte stream, fires signatures as patterns match, makes a forward/drop decision per packet. Proxy-based mode buffers the whole transaction in memory before deciding. UTM is just the umbrella name — it's what every interviewer means when they say "security profile".

The silent-disable trap — why Pooja's DLP stopped firing

Here is the part that catches even experienced engineers. When you flip a VDOM or policy from proxy-based to flow-based for throughput, FortiOS does not throw an error if a profile can't run in flow — on FortiOS 7.0/7.2 the DLP fingerprint and document-matching features simply stop enforcing. No log line, no alert. The policy looks healthy. The data just walks out.

That is exactly what bit Pooja: six months ago throughput was the priority, so the VDOM went flow-based. The DLP profile was still attached, still "enabled" in the GUI — but the engine that does fingerprint matching needs the proxy to hold the whole object, and in flow mode there is no whole object to hold.

config firewall policy
    edit 12
        set inspection-mode proxy
    next
end
# verify which mode a policy is in
show firewall policy 12 | grep inspection-mode

        set inspection-mode proxy

Web Filter + App Control — what wins when both fire

Back to the airport. Web Filter is the boarding-pass scan: it judges where you're going — the URL and its FortiGuard category. App Control is the X-ray: it judges what the traffic actually is — the L7 application, regardless of port. New engineers assume one overrides the other. It doesn't work like that.

The answer: they are independent gates, evaluated separately — a block in EITHER one drops the traffic. Web Filter allowed the category, but App Control independently blocked the upload sub-application. There is no "most-permissive wins" vote. Every attached profile is its own checkpoint, and any single block is final.

Web Filter also lets you override a single URL against its category — useful when FortiGuard miscategorises a site your business depends on. The order to remember: a static URL filter entry (allow/block/monitor) is checked before the FortiGuard category rating, so an explicit allow can rescue one site without opening the whole category.

IPS + AV — monitor vs block, and the CVE-2024-21762 trap

IPS is the behaviour analyst at the airport — it watches the stream for known attack patterns. The single biggest IPS mistake on FortiGate is confusing monitor with block. Monitor logs the match and lets the packet through. Block actually drops it. A sensor full of "monitor" filters generates beautiful dashboards and stops nothing.

The companion engine is AV. In flow it stream-scans for known malware; in proxy it reassembles and scans the whole file, which is what you need for grayware and sandbox handoff. For most user traffic flow-based AV with the extreme DB is plenty.

config ips sensor
    edit "protect-edge"
        config entries
            edit 1
                set severity high critical
                set action block
            next
        end
    next
end
# check current content/engine version
diagnose autoupdate versions | grep -A1 "IPS Attack Engine"

IPS Attack Engine
Version: 7.x.xxx   Contract Expiry: 2026-xx-xx   Last Updated: ...

SSL deep-inspection done right — CA push, pinned certs, exemptions

Most of the airport's "bags" are now sealed — encrypted in TLS. Web Filter can still read the destination from the SNI, but IPS, AV and DLP are blind to the contents unless you open the bag. That's SSL deep-inspection — and it's a controlled man-in-the-middle.

Two modes matter. Certificate-inspection reads only the SNI/certificate — no decryption, no client trust needed, but shallow. Deep-inspection terminates TLS, decrypts, inspects, then re-signs the session with the FortiGate CA and re-encrypts to the client. For that to work, every client must trust the FortiGate CA — push it via GPO (Windows), Intune/Jamf/MDM (Mac, mobile), and a Firefox enterprise policy for the ~5% on Firefox's own trust store.

Certificate pinning is the other half. Banking apps (HDFC, ICICI, SBI YONO), Apple services, some Microsoft activation flows and a few SaaS clients embed the expected issuer in their code. When the FortiGate substitutes its cert, they detect the mismatch and refuse to connect. You don't fight pinning — you exempt it, ideally via the FortiGuard Finance and Banking and Health and Wellness categories plus a small custom list.

config firewall ssl-ssh-profile
    edit "deep-custom"
        set server-cert-mode re-sign
        config https
            set ports 443
            set status deep-inspection
        end
        config ssl-exempt
            edit 1
                set type fortiguard-category
                set fortiguard-category 31
            next
        end
    next
end

profile "deep-custom" set · ssl-exempt: 1 entry (fortiguard-category 31)