If you enabled a Web Filter profile with Application Control, and the App Control action does not drop the traffic, no, it should not skip web filtering. However, if App Control drops the traffic, then Web Filter will not apply. How did you test your policy? Can you send me your configuration file and let me know which policy ID are you using?
you have to enable it for every protocol you'd like to scan.
Otherwise in proxy mode no av+webfiltering will work.
By default it should be enabled. I had also one unit/firmware there it was disabled by default.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.