FortiGate security profile coverage checker

Answers why is my profile not working before the ticket is raised. Walks the dependency chain and names which link failed.

Security & WAF

Runs entirely in your browser. Nothing is uploaded.

The dependency chain

  • A security profile only acts when every precondition above it holds: the policy must permit the traffic, SSL inspection must decrypt it, the inspection mode must support the feature, and only then does the profile act.
  • Most reports that a profile is not working resolve at the second step. The traffic is HTTPS, the policy carries certificate inspection rather than deep inspection, and there is nothing to read.
  • Certificate inspection validates the certificate and reads the handshake. It does NOT decrypt the payload, so AntiVirus, IPS, DLP and file filter have nothing to examine.
  • Application control and web filter degrade rather than go blind: SNI still identifies some hosts, but not URL paths or page content.
  • Describe a policy:
  • traffic: https
  • ssl: certificate
  • mode: flow
  • profiles: antivirus, ips, application-control, web-filter
API endpointGEThttps://ronutz.com/api/v1/fortigate-security-profile-coverage-checkerDocumented, not served. Opens the specification.

References