The antivirus profile successfully blocks the EICAR test file over unencrypted HTTP, which confirms that the antivirus engine and its definitions are functioning correctly. The failure to detect the virus when downloaded over encrypted HTTPS indicates that the FortiGate is not decrypting the traffic to inspect its content. For FortiGate to apply security profiles like Antivirus to encrypted traffic, the SSL/SSH Inspection profile must be configured for 'deep-inspection'. The described behavior suggests the profile is either not applied or is incorrectly set to 'certificate-inspection', which only examines the server certificate but does not decrypt and inspect the traffic payload.

A. Application control is not enabled: Application control is used to identify and manage applications; it is not the primary feature responsible for decrypting and scanning encrypted content for viruses.

C. Antivirus profile configuration is incorrect: The antivirus profile is proven to be working correctly because it successfully blocks the EICAR file over HTTP.

D. Antivirus definitions are not up to date: The antivirus definitions are effective, as demonstrated by the successful detection and blocking of the EICAR file in the unencrypted HTTP download.

---

1. Fortinet FortiOS 7.0.0 Administration Guide

Security Profiles > SSL/SSH Inspection

Page 1138.

The guide states: "Deep inspection... allows FortiGate to inspect the content of secure traffic... This allows FortiGate to enforce security features such as... Antivirus

Web Filtering

and DLP." This confirms that deep inspection is required for the antivirus profile to function on HTTPS traffic.

2. Fortinet FortiOS 7.0.0 Security Profiles Guide

SSL/SSH Inspection

Page 10.

This document explicitly differentiates the inspection modes: "Certificate Inspection... The content of the packet is not inspected... Deep Inspection... The content of the packet is inspected by FortiGuard and other security profiles." This directly supports the conclusion that the failure to inspect content is due to the SSL/SSH inspection mode.