Technical Tip: Processing Order of UTM Profiles in FortiGate Firewall Policies

[mriswan]

Description

This article describes the order of processing UTM profiles configured in firewall policies.

Scope

FortiGate.

Solution

FortiGate applies the inspection profiles in the following order:

1. IPS.
2. Application Control.
3. VoIP.
4. DLP.
5. Antispam.
6. Web Filtering.
7. Antivirus.

If the policy inspection mode is flow-based, the IPS engine is responsible for processing the traffic in the below order:
IPS -> Application Control -> Web Filtering -> DLP -> Botnet checking -> AntiVirus.

If the inspection mode is proxy-based, the IPS engine performs IPS, Application Control, and Botnet checking, the rest of the profiles will be handled by a proxy.

For a detailed explanation of the packet processing:

Parallel Path Processing