Web filter cannot see the URL path when…

Correct: a. Certificate-inspection sees SNI/cert, not path.

Fortinet · FortiOS 7.4 · Lesson 5 of 12

Profiles: UTM is blind inside TLS until you inspect

You attached web filter. Facebook still loads. The session is TLS 1.3. Certificate-inspection can only read SNI/cert. Deep inspection can see URLs — and it will break apps that pin certificates if you do not exempt them. This lesson is that trade, not a 40-profile shopping list.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Pick certificate-inspection vs deep-inspection vs no inspect.
Attach profiles on the policy that actually matches (lesson 3).
Exempt banking / pinning apps on deep inspection.
Prove with log: utmaction / hostname / profile.

The ticket

CISO: “Web filter is on.” Policy 3 has no profile. Policy 12 has web filter but is shadowed. And even on a hit, certificate-inspection cannot block a path inside the same hostname.

Quick interview answer

Security profiles (AV, IPS, web filter, app control, DLP) attach to a firewall policy. Encrypted traffic needs an SSL/SSH Inspection profile: certificate-inspection (outer cert/SNI) or deep-inspection (proxy, resign with your CA). FortiOS 7.4: deep inspection requires the client to trust the FortiGate CA. Pinning and mTLS fail — exempt those destinations.

TLS session that web filter cannot see without SSL inspection — A profile on a shadowed policy is decoration.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Mode	Sees	Breaks
No inspect	IPs, ports, some SNI if you cheat with DNS	Nothing — also no URL control
Certificate-inspection	Cert CN/SAN, SNI	Almost nothing
Deep-inspection	URLs, files, IPS inside TLS	Pinning, some apps, privacy optics

https://fgt-hq.techclick-lab.in

Training mock · not live

Admin

DashboardPolicyVPNNetwork

Security Profiles → SSL/SSH Inspection

deep-inspection-lab

Inspection method

Full SSL Inspection (deep)

CA certificate

Fortinet_CA_SSL / Lab_CA

Exempt

windows.com, apple.com, banking category

Used by policy

id 8 LAN → WAN

FortiOS 7.4 SSL/SSH Inspection. Training mock.

How to choose

Guest Wi-Fi: certificate-inspection. Corp laptops with GPO root: deep-inspection + exemption list. Servers to Azure: often no deep inspect — you will break APIs.

Runbook

Side A — CA
Export FortiGate CA. GPO to Priya’s Trusted Root. Without this, browsers scream.
Side B — policy
On the policy that Policy match actually hits: web filter + SSL profile.
Side C — prove
Web filter log shows hostname + cat. Deep inspect: URL path. Certificate-only: no path.

What you should see

# Log & Report → Security Events → Web Filter
srcip=10.20.30.80 hostname=www.facebook.com cat=Social.Media action=blocked
# If this line never appears, you are on policy 3 or you are not inspecting.

Four failures

1 · Profile on shadowed policy

Lesson 3 again.

2 · Deep inspect, no CA in store

“The firewall broke HTTPS.” It unwrapped TLS with a CA nobody trusts.

3 · Pinning / Windows Update

Exempt. Do not disable the whole profile.

4 · Flow vs proxy

Some inspections need proxy. Know which profile you attached.

How to prove it

Close only when

1) Policy match id has the profile. 2) One blocked category log exists. 3) Exempt list covers the broken app. 4) You did not turn off TLS to “make it work.”

Traps

Complaint	First check
Filter does nothing	policyid + SSL mode
One site cert warning	CA trust / exemption

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview