Enabling security services

FortiGate security services extend basic firewall policies with deep traffic inspection capabilities. Available services depend on your license tier.

Security services are applied to traffic by attaching security profiles to firewall policies. A firewall policy must exist before you can attach a security profile to it. For instructions on creating firewall policies, see Configuring your FortiGate firewall after deployment.

Available security services by license tier

Security services available by license tier
Service ATP UTP Enterprise
Intrusion Prevention (IPS) Checkmark icon Checkmark icon Checkmark icon
Antivirus Checkmark icon Checkmark icon Checkmark icon
Web Filtering Checkmark icon Checkmark icon
DNS Filtering Checkmark icon Checkmark icon
Application Control Checkmark icon Checkmark icon

Enabling multiple security services on the same firewall policy increases CPU usage and can reduce throughput. Select a deployment with sufficient vCPU capacity for your workload. For more information, see About firewall license plans and instance profiles.

Deep packet inspection

Security services such as IPS, antivirus, web filtering, and application control require deep packet inspection (DPI) to examine the contents of network traffic. For encrypted traffic (HTTPS and other TLS-based protocols), FortiGate-VM must perform SSL/TLS inspection to decrypt, inspect, and re-encrypt the traffic before it reaches its destination.

Without SSL/TLS inspection enabled, FortiGate-VM can only inspect unencrypted traffic. Security profiles attached to firewall policies will not detect threats or enforce policies within encrypted sessions.

FortiGate-VM supports two SSL inspection modes:

  • Certificate inspection — Inspects the certificate presented during the TLS handshake without decrypting the payload. This is a lighter-weight option that can identify the destination and enforce basic controls, but cannot detect threats hidden inside encrypted content.
  • Full SSL inspection — Decrypts, inspects, and re-encrypts traffic. This enables all security services to operate on encrypted traffic, providing the highest level of protection. It requires deploying the FortiGate CA certificate to client devices so that they trust the re-signed certificates.

For step-by-step instructions on configuring SSL/TLS inspection, see the FortiGate SSL inspection documentation.

Enabling security profiles

Security profiles are created and then attached to firewall policies to apply inspection to matching traffic flows.

Intrusion Prevention System (IPS)

IPS monitors traffic for known attack signatures and anomalies and can block or log matching traffic.

  1. In the FortiGate web console, go to Security Profiles > Intrusion Prevention.
  2. Create a new IPS sensor or modify the default sensor.
  3. Add signatures relevant to your environment and set the action to Block or Monitor.
  4. Attach the IPS sensor to your firewall policy under Security Profiles > IPS.

For more information, see the FortiGate IPS documentation.

Antivirus

Antivirus scanning inspects file transfers for malware in supported protocols (HTTP, HTTPS with SSL inspection, FTP, SMTP, and others).

  1. In the FortiGate web console, go to Security Profiles > AntiVirus.
  2. Create or modify an antivirus profile and set the action for infected files.
  3. Attach the profile to your firewall policy under Security Profiles > AntiVirus.

For more information, see the FortiGate antivirus documentation.

Web filtering

Web filtering controls access to websites based on categories, URLs, and content ratings.

  1. In the FortiGate web console, go to Security Profiles > Web Filter.
  2. Create or modify a web filter profile, enabling or blocking categories as required.
  3. Attach the profile to your firewall policy under Security Profiles > Web Filter.

For more information, see the FortiGate web filtering documentation.

Application control

Application control identifies and controls applications regardless of port or protocol by using Fortinet's application signature database.

  1. In the FortiGate web console, go to Security Profiles > Application Control.
  2. Create or modify an application control profile and set actions for application categories.
  3. Attach the profile to your firewall policy under Security Profiles > Application Control.

For more information, see the FortiGate application control documentation.