The FortiOS Intrusion Prevention System (IPS) engine is a core component that performs pattern matching and protocol decoding for multiple security functions, especially in flow-based inspection mode. Application control is fundamentally built on the IPS engine, using its decoders and signature-matching capabilities to identify application traffic. Similarly, when operating in flow-based mode, both the web filter and antivirus features leverage the high-performance IPS engine to scan traffic content for threats and policy violations without the need for full proxying, enabling faster throughput.

C. DNS filter: This feature is primarily handled by a dedicated daemon (dnsfilterd) and process, which is distinct from the core IPS engine used for general signature matching.

D. Web application firewall: The WAF feature on a FortiGate uses its own specialized engine for deep inspection of HTTP/S traffic and protection against web application attacks, separate from the IPS engine.

1. Fortinet FortiOS 7.0.0 Administration Guide: In the "Security Profiles" section

under "Application Control

" it is stated that "Application control uses IPS protocol decoders and signatures to identify the applications that generate network traffic." (p. 689).

2. Fortinet FortiOS 7.0.0 Handbook - Architecture: The "Life of a Packet" chapter details the packet flow. In the flow-based inspection path

the diagram and accompanying text show that the ipsengine is responsible for processing IPS

Application Control

flow-based Web Filtering

and flow-based Antivirus. (Section: "Flow-based inspection").

3. Fortinet FortiOS 7.0.0 Handbook - Security Profiles: The "Antivirus" chapter explains

"In flow-based inspection

the FortiGate uses the IPS engine to scan content as it passes through the FortiGate without any buffering." This same principle is described for flow-based Web Filtering. (Section: "Inspection modes").