{"id":55668,"date":"2020-01-25T00:00:00","date_gmt":"2020-01-24T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/6-fortinet-getting-started-v6-0-web-filtering-i-application-control"},"modified":"2020-02-18T14:03:48","modified_gmt":"2020-02-18T11:03:48","slug":"6-fortinet-getting-started-v6-0-web-filtering-i-application-control","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/6-fortinet-getting-started-v6-0-web-filtering-i-application-control","title":{"rendered":"6. Fortinet Getting Started v6.0. Web Filtering and Application Control","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"6.
\n
\nWelcome! You are in the sixth lesson of the course Fortinet Getting Started<\/a><\/noindex>. On previous lesson<\/a><\/noindex> we have mastered the basics of working with NAT technology on FortiGate<\/a><\/noindex>, and we have also released our test user to the Internet. Now it\u2019s time to ensure the user's security in this vast space. In this lesson, we will explore the following security profiles: Web Filtering, Application Control, and HTTPS inspection.<\/a><\/noindex><\/p>\n

To start getting acquainted with security profiles, we need to understand one more thing\u2014inspection modes. <\/p>\n

\"6.
\n
\nBy default, Flow Based mode is used. It checks files as they pass through FortiGate without buffering. As soon as the packet arrives, it is processed and forwarded without waiting for the entire file or webpage. It requires fewer resources and provides higher performance than Proxy mode, but not all security functionalities are available in it. For example, data loss prevention (DLP) can only be used in Proxy mode.
\nProxy mode works differently. It creates two TCP connections, one between the client and FortiGate, the other between FortiGate and the server. This allows it to buffer traffic, meaning it can receive the entire file or webpage. Scanning files for various threats begins only after the whole file has been buffered. This allows for additional capabilities that are not available in Flow Based mode. As you can see, this mode is somewhat the opposite of Flow Based\u2014security is the main focus here, while performance takes a back seat.
\nPeople often ask\u2014 which mode is better? However, there is no universal answer. It is always individual and depends on your needs and objectives. I will further demonstrate the differences between security profiles in Flow and Proxy modes throughout the course. This will help you compare functionalities and decide which one suits you best. <\/p>\n

Let\u2019s move on to the security profiles and first explore Web Filtering. It helps control or monitor which websites users visit. I believe there is no need to delve into the necessity of such a profile in today's reality. Let\u2019s find out how it works.<\/p>\n

\"6.
\n
\nOnce a TCP connection is established, the user requests content from a specific website using a GET request.<\/p>\n

If the web server responds positively, it sends the information about the website in reply. This is where the web filter comes into play. It checks the content of this response. During this check, FortiGate sends a request in real-time to the FortiGuard Distribution Network (FDN) to determine the category of the website. Once the category of the specific website is identified, the web filter takes specific actions based on settings.
\nIn Flow mode, three actions are available: <\/p>\n