A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through…

For FortiGate to inspect encrypted traffic, such as HTTPS, it must perform deep SSL inspection. This process involves decrypting the traffic, applying security profiles like antivirus, and then re-encrypting it. The scenario indicates that the antivirus scan fails for HTTPS but works for HTTP, pointing directly to an issue with the SSL inspection process. Two primary configuration issues would cause this: 1. The SSL inspection profile is set to Certificate Inspection mode. This mode only examines the server's certificate metadata and does not decrypt the actual data payload, preventing the antivirus engine from scanning the file content. 2. The specific website is included in an SSL inspection exemption list. This explicitly instructs the FortiGate to bypass deep inspection for that site, allowing the encrypted traffic to pass through uninspected.

B. The browser does not trust the FortiGate self-signed CA certificate: This would cause a certificate warning in the browser. If the user bypasses the warning, the traffic would still be subject to deep inspection as configured on the FortiGate. C. The EICAR test file exceeds the protocol options oversize limit: The EICAR test file is a 68-byte string, which is extremely unlikely to exceed any configured oversize limit, as these are typically set in megabytes.

1. Fortinet FortiOS 7.0.0 Administration Guide, Page 1020, "SSL/TLS inspection > Inspection modes". This section explicitly states: "In [SSL certificate inspection] mode, the FortiGate unit only inspects the SSL certificate... The FortiGate unit does not decrypt the SSL traffic." This supports option A.

2. Fortinet FortiOS 7.0.0 Administration Guide, Page 1026, "SSL/TLS inspection > Exempting traffic from SSL inspection". This section details how to exempt traffic based on category or URL, which would prevent deep inspection and subsequent antivirus scanning. This supports option D.

3. Fortinet FortiOS 7.0.0 Administration Guide, Page 1021, "Full SSL inspection (deep inspection)". This section explains that for deep inspection to work without errors, "the FortiGate CA certificate must be installed on all end-user's browsers," confirming that a lack of trust (Option B) causes a browser-side error, not a bypass of the inspection policy itself.