Recommended Security Profile strategy:
Security Profiles should not be applied uniformly to all firewall policies without review.
Different inspection levels should be used based on traffic direction and risk.
Recommended profile strategy.
User Internet access should use Web Filter, DNS Filter, Antivirus, Intrusion Prevention System, Application Control, and SSL Inspection. Server outbound access should use DNS Filter, Antivirus, Intrusion Prevention System, and Application Control. Inbound server publishing should use Intrusion Prevention System, Antivirus, Web Application Firewall when available, and SSL Inspection where applicable. Guest network access should use Web Filter, DNS Filter, Application Control, and Antivirus. SSL VPN traffic should use the same controls as internal user traffic where possible. Critical systems should use strict Intrusion Prevention System inspection, Antivirus, DNS Filter, and limited application access.
Antivirus best practices:
Enable Antivirus on firewall policies that allow Internet access, email, file downloads, or user browsing traffic.
Example configuration:
config antivirus profile
edit 'AV-Standard'
set comment 'Standard antivirus profile for user Internet traffic'
set inspection-mode proxy
set ems-threat-feed enable
set outbreak-prevention block
set external-blocklist-enable-all enable
next
end
Recommended protections:
Block known malware. Enable FortiGuard outbreak prevention. Scan HTTP, HTTPS, FTP, SMTP, POP3, and IMAP where applicable. Use proxy-based inspection when deeper inspection is required. Use flow-based inspection when performance is more important.
For high-throughput environments, flow-based Antivirus is recommended unless deep inspection is required.
For user browsing, Antivirus should be combined with Web Filter, DNS Filter, SSL Deep Inspection, and Application Control.
Web Filter best practices.
Use Web Filter to control access to malicious, inappropriate, or risky websites.
Recommended blocked categories:
Example configuration:
config webfilter profile
edit 'WF-Corporate'
set comment 'Corporate web filtering profile'
config ftgd-wf
unset options
config filters
edit 1
set category 2
set action block
next
edit 2
set category 7
set action block
next
edit 3
set category 8
set action block
next
end
end
next
end
Use warning or monitor mode before blocking broad business-sensitive categories.
Avoid overblocking cloud storage, personal email, social media, and streaming media unless required by policy.
Enable logging for blocked and monitored categories.
DNS Filter best practices.
DNS Filter is recommended because it can stop malicious connections before HTTP or HTTPS traffic begins.
Enable DNS Filter on user, server, guest, and SSL VPN firewall policies.
Recommended actions.
Malware domains should be blocked. Phishing domains should be blocked. Botnet C&C domains should be blocked. Newly registered domains should be monitored or blocked. Dynamic DNS should be monitored or blocked. Parked domains should be monitored. Safe search enforcement should be enabled where required.
Example configuration:
config dnsfilter profile
edit 'DNS-Corporate'
set comment 'Corporate DNS security profile'
set block-action block
set log-all-domain enable
set sdns-ftgd-err-log enable
config ftgd-dns
config filters
edit 1
set category 2
set action block
next
edit 2
set category 7
set action block
next
end
end
next
end
Use DNS Filter even when Web Filter is enabled.
For internal DNS servers, apply DNS Filter to the firewall policy that allows DNS servers to query the Internet.
Application Control best practices.
Use Application Control to identify and control risky applications.
Recommended blocks or restrictions.
Remote access tools not approved by IT. Peer-to-peer applications. Proxy and tunneling applications. Cryptocurrency mining. Unauthorized VPN tools. High-risk file sharing. Known evasive applications.
Example configuration.
config application list
edit 'APP-Corporate'
set comment 'Corporate application control profile'
config entries
edit 1
set category 6
set action block
next
edit 2
set category 2
set action monitor
next
end
next
end
Start in monitor mode before enforcing strict blocks.
Use Application Control with SSL Deep Inspection for better detection of encrypted applications.
Application Control signatures should be kept updated through FortiGuard.
Intrusion Prevention System best practices.
Enable Intrusion Prevention System on traffic that crosses security zones.
Recommended inspection points.
Internet to internal servers. User LAN to Internet. SSL VPN to internal network. Guest to Internet. Server VLAN to critical systems. DMZ to internal network.
Example configuration.
config ips sensor
edit 'IPS-Corporate'
set comment 'Corporate Intrusion Prevention System profile'
config entries
edit 1
set severity high critical
set status enable
set action block
next
edit 2
set severity medium
set status enable
set action default
next
end
next
end
Do not enable every Intrusion Prevention System signature without review.
Use targeted Intrusion Prevention System profiles based on operating systems, applications, and exposed services.
For inbound published services, tune profiles to match the protected server type, such as Windows Server, Linux Server, Apache, NGINX, Microsoft IIS, SQL, Exchange, and VPN portals.
Monitor Intrusion Prevention System logs regularly and tune false positives.
SSL/SSH Inspection best practices.
Use SSL Inspection because most modern traffic is encrypted.
Without SSL Inspection, many Security Profiles have limited visibility.
Recommended inspection types.
Certificate Inspection provides basic URL category and certificate checks. Deep Inspection provides full content inspection of HTTPS traffic. SSH Inspection detects tunneling and risky SSH activity.
Example configuration.
config firewall ssl-ssh-profile
edit 'SSL-Deep-Inspection-Corporate'
set comment 'Deep SSL inspection for corporate endpoints'
config https
set ports 443
set status deep-inspection
end
config ftps
set ports 990
set status deep-inspection
end
config smtps
set ports 465
set status deep-inspection
end
config ssh
set ports 22
set status deep-inspection
end
next
end
Before enabling Deep Inspection, install the FortiGate CA certificate on endpoint devices.
Exempt financial, healthcare, legal, and privacy-sensitive sites if required.
Exempt applications that are not compatible with SSL Inspection.
Test with a pilot user group first.
Use different SSL profiles for users, servers, and guests.
Do not apply Deep Inspection to traffic where legal, regulatory, or privacy requirements prohibit inspection.
File Filter best practices.
Use File Filter to block high-risk file types from untrusted sources.
Common risky file types:
Executables, such as .exe, .msi, .bat, .cmd, and .scr. Scripts, such as .js, .vbs, and .ps1. Archives, such as .zip, .rar, and .7z, especially password-protected archives. Office files with macros. Disk images, such as .iso and .img.
Example configuration.
config file-filter profile
edit 'FILE-Corporate'
set comment 'Block risky file types'
config rules
edit 1
set name 'Block-Executables'
set protocol http ftp
set action block
set direction any
next
end
next
end
Use monitor mode first to understand business impact.
For high-security environments, block executable downloads except from approved update repositories.
Anti-Spam best practices.
Enable Anti-Spam on mail-related firewall policies when FortiGate inspects SMTP, POP3, or IMAP traffic.
Recommended protections.
Example configuration.
config spamfilter profile
edit 'SPAM-Corporate'
set comment 'Corporate anti-spam profile'
config spam-filtering
set spam-filtering enable
end
next
end
A dedicated secure email gateway is recommended when advanced email security is required.
FortiGate Anti-Spam is useful for basic mail filtering, but it should not replace a full email security platform in large environments.
Data Leak Prevention best practices.
Use Data Leak Prevention carefully because false positives can occur when it is deployed too broadly.
Recommended use cases.
Prevent credit card data leakage. Detect personally identifiable information. Block sensitive file transfers. Monitor confidential keywords. Control uploads to webmail or cloud storage.
Recommended rollout process.
Start in monitor mode. Review logs. Tune patterns and exclusions. Apply block actions only to confirmed violations.
Example configuration.
config dlp profile
edit 'DLP-Monitor'
set comment 'Monitor sensitive data leakage'
next
end
Logging best practices.
Security Profiles are effective only when logs are reviewed.
Enable logging on security policies.
config firewall policy
edit <policy_id>
set logtraffic all
set utm-status enable
next
end
Enable security event logging for Antivirus detections, Web Filter blocks, DNS Filter blocks, Application Control violations, Intrusion Prevention System attacks, SSL Inspection errors, File Filter blocks, and Data Leak Prevention events.
FortiAnalyzer should be used where available.
Suggested log retention is 30 to 90 days for small business environments, 90 to 180 days for enterprise environments, and based on compliance requirements for regulated industries.
FortiGuard best practices.
Security Profiles depend heavily on FortiGuard updates.
Verify FortiGuard connectivity.
diagnose autoupdate versions
diagnose debug rating
execute update-now
Check license status.
get system status
diagnose autoupdate versions
Make sure the firewall can reach FortiGuard services.
Use override FortiGuard servers only when required.
Keep Antivirus signatures, Intrusion Prevention System signatures, Application Control database, Web Filter database, DNS Filter database, Botnet database, and GeoIP database updated.
Firewall policy best practices with Security Profiles.
Security Profiles must be enabled for every firewall policy.
Example policy.
config firewall policy
edit 100
set name 'LAN-to-Internet-Secure'
set srcintf 'lan'
set dstintf 'wan1'
set srcaddr 'LAN_Subnet'
set dstaddr 'all'
set action accept
set schedule 'always'
set service 'ALL'
set nat enable
set utm-status enable
set ssl-ssh-profile 'SSL-Deep-Inspection-Corporate'
set av-profile 'AV-Standard'
set webfilter-profile 'WF-Corporate'
set dnsfilter-profile 'DNS-Corporate'
set application-list 'APP-Corporate'
set ips-sensor 'IPS-Corporate'
set logtraffic all
next
end
Avoid using service ALL where specific services can be defined.
Place more specific policies above general policies.
Apply profiles based on traffic risk.
Recommended baseline profiles.
Corporate user Internet policy.
Guest Internet policy. Server outbound policy. Inbound virtual IP or destination NAT policy. Intrusion Prevention System. Antivirus where applicable. SSL Inspection where applicable. Web Application Firewall profile when supported. Logging.
Performance best practices.
Security inspection can increase CPU and memory usage.
Monitor performance.
get system performance status
diagnose sys top
diagnose hardware sysinfo memory
diagnose npu np6 session-stats
Check session load.
diagnose sys session stat
Use Security Processing Unit acceleration where available.
Use flow-based inspection for high-throughput environments.
Use proxy-based inspection where deeper inspection is required.
Avoid applying heavy profiles to unnecessary traffic.
Use separate policies for trusted internal traffic and untrusted Internet traffic.
Troubleshooting commands.
Check policy profile configuration.
show firewall policy <policy_id>
Check Security Profile configuration.
show antivirus profile
show webfilter profile
show dnsfilter profile
show application list
show ips sensor
show firewall ssl-ssh-profile
Check FortiGuard updates.
diagnose autoupdate versions
execute update-now
Debug Web Filter rating.
diagnose debug rating
Check logs in the CLI.
execute log filter category 1
execute log display
Debug flow for policy matching.
diagnose debug reset
diagnose debug flow filter addr <client_ip>
diagnose debug flow show function-name enable
diagnose debug flow trace start 100
diagnose debug enable
Stop the debug processes.
diagnose debug disable
diagnose debug reset
Common issues:
Website blocked unexpectedly.
Recommended checks.
diagnose debug rating
show webfilter profile
execute log display
Possible causes.
HTTPS sites fail after enabling Deep Inspection.
Recommended checks.
show firewall ssl-ssh-profile
get vpn certificate local
Possible causes.
FortiGate CA certificate is not installed on the endpoint. Certificate pinning is used by the application. Unsupported TLS behavior is present. The application is incompatible with SSL Inspection.
Resolution. Install the FortiGate CA certificate. Add an SSL exemption for the affected destination. Use Certificate Inspection for incompatible applications.
High CPU after enabling profiles.
Recommended checks.
get system performance status
diagnose sys top
diagnose sys session stat
Possible causes.
Too many Deep Inspection policies. Intrusion Prevention System profile is too broad. Proxy inspection load is high. Logging volume is high. FortiGate model is undersized.
Resolution. Tune Intrusion Prevention System signatures. Use flow-based inspection where appropriate. Reduce unnecessary SSL Deep Inspection. Split policies by traffic type. Review hardware sizing.
Recommended deployment process. Create baseline profiles. Apply profiles to a limited test policy. Start Application Control, Data Leak Prevention, and File Filter in monitor mode. Review logs for false positives. Tune allowlists, exemptions, and category actions. Deploy to a pilot user group. Expand gradually. Review logs and FortiGuard updates regularly.
Final recommendations.
Use layered inspection instead of relying on a single Security Profile.
Recommended minimum baseline for user Internet traffic.
SSL Inspection + Antivirus + Web Filter + DNS Filter + Application Control + Intrusion Prevention System + Logging
For best results, keep FortiGuard services licensed and updated.
Use SSL Deep Inspection where legally and operationally acceptable.
Tune Intrusion Prevention System and Application Control instead of enabling all signatures blindly.
Log all security events.
Review logs regularly in FortiAnalyzer or FortiGate.
Use different profiles for users, guests, servers, SSL VPN traffic, and inbound services.
| 
