# Profiles: UTM is blind inside TLS until you inspect Source: https://ai.techclick.in/blog_fortigate_security_profiles_ssl Markdown: https://ai.techclick.in/blog_fortigate_security_profiles_ssl.md Publisher: Techclick Infosec Pvt Ltd AV, IPS, web filter only see inside TLS if SSL inspection is designed. Dummy lab CA on Priya. ## The ticket CISO: “Web filter is on.” Policy 3 has no profile. Policy 12 has web filter but is shadowed. And even on a hit, certificate-inspection cannot block a path inside the same hostname. Quick interview answer Security profiles (AV, IPS, web filter, app control, DLP) attach to a firewall policy. Encrypted traffic needs an SSL/SSH Inspection profile: certificate-inspection (outer cert/SNI) or deep-inspection (proxy, resign with your CA). FortiOS 7.4: deep inspection requires the client to trust the FortiGate CA. Pinning and mTLS fail — exempt those destinations. Hero · closed envelope A profile on a shadowed policy is decoration. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Mode Sees Breaks No inspect IPs, ports, some SNI if you cheat with DNS Nothing — also no URL control Certificate-inspection Cert CN/SAN, SNI Almost nothing Deep-inspection URLs, files, IPS inside TLS Pinning, some apps, privacy optics https://fgt-hq.techclick-lab.in Training mock · not live Admin Dashboard Policy VPN Network Security Profiles → SSL/SSH Inspection ### deep-inspection-lab Inspection method Full SSL Inspection (deep) CA certificate Fortinet_CA_SSL / Lab_CA Exempt windows.com, apple.com, banking category Used by policy id 8 LAN → WAN Cancel Save FortiOS 7.4 SSL/SSH Inspection. Training mock. ## How to choose Guest Wi-Fi: certificate-inspection. Corp laptops with GPO root: deep-inspection + exemption list. Servers to Azure: often no deep inspect — you will break APIs. ## Runbook - #### Side A — CA Export FortiGate CA. GPO to Priya’s Trusted Root. Without this, browsers scream. - #### Side B — policy On the policy that Policy match actually hits: web filter + SSL profile. - #### Side C — prove Web filter log shows hostname + cat. Deep inspect: URL path. Certificate-only: no path. What you should see # Log & Report → Security Events → Web Filter srcip=10.20.30.80 hostname=www.facebook.com cat=Social.Media action=blocked # If this line never appears, you are on policy 3 or you are not inspecting. ## Four failures ### 1 · Profile on shadowed policy Lesson 3 again. ### 2 · Deep inspect, no CA in store “The firewall broke HTTPS.” It unwrapped TLS with a CA nobody trusts. ### 3 · Pinning / Windows Update Exempt. Do not disable the whole profile. ### 4 · Flow vs proxy Some inspections need proxy. Know which profile you attached. ## How to prove it Close only when 1) Policy match id has the profile. 2) One blocked category log exists. 3) Exempt list covers the broken app. 4) You did not turn off TLS to “make it work.” ## Traps Complaint First check Filter does nothing policyid + SSL mode One site cert warning CA trust / exemption ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Web filter cannot see the URL path when… You use certificate-inspection only The policy is a deny SNAT is on You use zones Correct: a . Certificate-inspection sees SNI/cert, not path. Q2 Deep inspection requires… Clients trust the FortiGate CA FMG Two WAN links Central SNAT Correct: a . Concept. Q3 Profile attached to policy 12, traffic hits policy 3. Result? Filter still runs No profile — first match has no UTM Implicit deny FAZ blocks it Correct: b . Shadow. Q4 Windows Update breaks after deep inspect. First move? Exempt the vendor destinations Disable all HTTPS Delete the CA Turn off NAT Correct: a . Failure 3. Q5 Certificate-inspection is the better default when… You need file AV inside TLS You cannot deploy a CA and still want SNI/category You want DLP on POST bodies You run SSL-VPN only Correct: b . Choose. Q6 Proof that web filter fired is… A Security Events / web filter log line get system status FMG install OK VIP session Correct: a . Runbook. Check answers Reset FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview ## Sources - FortiOS 7.4 — SSL/SSH inspection (certificate vs full/deep) . - FortiOS 7.4 — Web filter . Related: FortiGate session factory · VPN series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt