The FortiGate Intrusion Prevention System (IPS) engine is a core component of the single-pass architecture responsible for protocol decoding and signature-based threat detection. This powerful engine is leveraged by several other security features. Application Control uses the IPS engine and its decoders to identify and control thousands of applications. The DNS Filter uses the IPS engine to inspect DNS traffic for malicious patterns and threats. Similarly, the Web Application Firewall (WAF) feature relies on the IPS engine to apply its signature set to protect against common web application attacks like SQL injection and cross-site scripting.

A. Antivirus in flow-based inspection: Antivirus scanning uses a separate, dedicated antivirus (AV) engine and malware signature database, distinct from the IPS engine.

B. Web filter in flow-based inspection: The primary mechanism for Web Filtering is URL categorization and rating lookups against the FortiGuard database, not the IPS signature engine.

1. FortiOS 7.0.1 Administration Guide, "Application control" section, p. 826. It states, "Application control uses IPS protocol decoders..."

2. FortiOS 7.0.1 Administration Guide, "DNS filter" section, p. 880. It mentions that the DNS filter profile uses the IPS engine to scan DNS traffic.

3. FortiOS 7.0.1 Administration Guide, "Web application firewall" section, p. 900. The guide explains that WAF uses the IPS engine and signatures to protect servers from malicious attacks.