Inspect All the traffic of clients.

In terms of URL tracking, Web Filter security profile does the job. You'll just need to set all the Allowed categories to Monitor so that legitimate websites will be logged as well.

To prevent certificate errors while using DPI, follow this document: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-deep-inspection-and-import-a/ta-p/196840 Alternatively, use a CA Certificate that is signed by a 3rd party instead of using Fortigate's CA certificate for the purpose of doing deep packet inspection.

Hi @mohar,

I believe Web filter should do the job. Please refer to this document https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/833698/web-filter

Regards,
Minh

Hi @mohar,

You can use SSL deep inspection and whitelist websites that don't allow DPI. Please refer to this article on how to exempt: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-exempt-government-category-from-deep/ta-p/193550. 

Regards, 

Hello @mohar 

You may want to use Proxy inspection mode for your requirement. Here is more information on that:
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/969330/proxy-mode-inspection

In proxy mode, fortigate will act as intermediary and sessions created by user will be proxied by the fortigate. This allows fortigate to inspect the content of the sessions and allows more control over what is allowed. 

Here is how you can change the inspection mode:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-the-inspection-mode-of-the-firewall/ta-p/193983

You will also need to have SSL Deep inspection:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-deep-inspection-and-import-a/ta-p/196840

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/122078/deep-inspection

If you have additional question, let me know.

Regards,

Varun