Domain 3 Content inspection
trapmemorisedefault valuenew in 7.6
§3.1 Certificates & encrypted traffic
The default re-signing CA is Fortinet_CA_SSL. If the server's certificate is invalid, FortiGate re-signs with Fortinet_CA_Untrusted instead — deliberately, so the browser warning still reaches the user. That is not a bug and it is a question.
Certificate pinning and HSTS break deep inspection — banking apps, Windows Update, Apple and Microsoft services. The correct fix is an SSL exemption for those destinations, never "turn off inspection." Finance and Health categories are exempt by default.
Related settings: set untrusted-caname, set allow-invalid-server-cert, set expired-server-cert. Know the difference between the CA certificate with a private key used to re-sign, and a server certificate used for the admin GUI or SSL VPN.
§3.2 Inspection modes & web filtering
FortiGuard category actions: Allow · Monitor (allow and log) · Block · Warning (interstitial with a timer) · Authenticate (require credentials to continue).
Local categories and rating overrides let you reclassify a site.
Safe search and the YouTube education filter require deep inspection.
DNS filtering is a separate profile and works without deep inspection.
§3.3 Application control
Application control runs on the IPS engine, so it is always flow-based — even inside a proxy-based policy.
Match order — most specific first:
Actions: Allow, Monitor, Block, Quarantine. Categories can also be traffic-shaped per application.
Most HTTPS applications need deep inspection for real identification — certificate inspection gives you coarse SNI matching only.
unknown-application-action and unknown-application-log handle unclassified traffic.
Network protocol enforcement (only expected protocols on a port) lives inside app control.
§3.4 Antivirus
Oversize files. Anything larger than oversize-limit is not scanned, and the default behaviour is to pass it through. Whether it passes or blocks is set in the protocol options profile — a separate object from the AV profile, and the answer to most "why isn't it scanning?" questions.
Detection layers: signature · grayware · AI / machine-learning detection · FortiGuard Outbreak Prevention (real-time hash lookup, needs a license and connectivity) · EMS threat feeds.
Databases: normal / extended / extreme. Quarantine to disk needs a model with storage.
§3.5 IPS
An IPS sensor is one or more filters (severity, target, protocol, OS, application) plus optional individual signature entries. Signature entries are evaluated first.
Actions: Allow, Monitor, Block, Reset, Quarantine, or default (use the signature's own recommended action).
Rate-based signatures need a threshold, a duration, and a track-by (source or destination) — used for brute force patterns.
set packet-logging enable captures offending packets and costs memory.
DoS policies are separate from IPS sensors and are evaluated before firewall policies.
Under config ips global: fail-open decides whether traffic passes when the engine is overloaded. ips-reserve-cpu and engine-count are the tuning knobs.