FortiGate security profile coverage checker
Answers why is my profile not working before the ticket is raised. Walks the dependency chain and names which link failed.
Security & WAFRuns entirely in your browser. Nothing is uploaded.
The dependency chain
- A security profile only acts when every precondition above it holds: the policy must permit the traffic, SSL inspection must decrypt it, the inspection mode must support the feature, and only then does the profile act.
- Most reports that a profile is not working resolve at the second step. The traffic is HTTPS, the policy carries certificate inspection rather than deep inspection, and there is nothing to read.
- Certificate inspection validates the certificate and reads the handshake. It does NOT decrypt the payload, so AntiVirus, IPS, DLP and file filter have nothing to examine.
- Application control and web filter degrade rather than go blind: SNI still identifies some hosts, but not URL paths or page content.
- Describe a policy:
- traffic: https
- ssl: certificate
- mode: flow
- profiles: antivirus, ips, application-control, web-filter
API endpointGEThttps://ronutz.com/api/v1/fortigate-security-profile-coverage-checkerDocumented, not served. Opens the specification.