Technical Tip: FortiGuard Category not exempted in deep-inspection when exempt is use

The SSL/SSH deep-inspection profile has the option to exempt a host or FortiGuard Category.

There is an issue when deep-inspection still occurs because an IP rating category is preferred, which causes the websites to get inspected.

In this example, the Government and Legal Organizations category is set to exempt.

Refer to this article: Technical Tip: How to check the web filtering categories corresponding to the category ID for category ID.

However, a government website is still getting inspected.

Running a WAD debug:

[I]2026-03-18 03:28:19.061213 [p:2557] wad_url_filter_dump_result :231 wad_url_filter_on_read(dump) id=1183 state=verdict type=req_https has_cat
=0[0] log=0 result: id=1183 log=0 cate=56(51/56) flags=00000001 action=ftgd-monitor warn_domain=0 warn_session=0
[I]2026-03-18 03:28:19.061249 [p:2557][s:635403] wad_url_filter_dump_result :231 wad_url_filter_check_url_filter_on_result(dump) id=1183 state=done type=r
eq_https has_cat=0[0] log=0 result: id=1183 log=0 cate=56(51/56) flags=00000001 action=ftgd-allow warn_domain=0 warn_session=0
[I]2026-03-18 03:28:19.061302 [p:2557][s:635403] wad_url_choose_cate :2212 cate=56 (ftgd) ip-cates=[56,]; url=[ # 51,],ip=[ # 56,]; conf sslexempt_
rating '':[194,33,51,31,]

It shows the correct category matching, but the IP category is 56, which causes the website to get inspected.

A workaround is to disable the IP rating in the SSL/SSH profile.

The ssl-exemption-ip-rating and address-ip-rating options are enabled by default, so when both a website domain and its IP address return different categories after being rated by FortiGuard, the IP address category takes precedence when evaluating SSL exemptions associated with the SSL inspection profile