FortiGate Deep Packet Inspection: What Indian Enterprises Must Enable in 2025

• 09 September, 2026
• No Comments

When a 400-person manufacturing company in Pune discovered that their firewall had been logging encrypted traffic for six months without inspecting a single byte of it, the CISO’s reaction was disbelief. Their FortiGate was licensed, updated, and running — but Deep Packet Inspection (DPI) had never been switched on. Within those six months, an attacker had quietly exfiltrated engineering drawings through an HTTPS channel the firewall simply waved through. It is one of the most expensive misconfigurations in enterprise security — and it is far more common in India than most IT teams realise.

This guide explains what Deep Packet Inspection is, why it matters specifically for Indian enterprises in 2025, how to configure it on FortiGate correctly, and the operational traps to avoid. If your organisation runs FortiGate as its perimeter or branch firewall — whether managed in-house or through an MSSP — read this before your next quarterly security review.

What Is Deep Packet Inspection and Why Does It Matter?

A traditional stateful firewall inspects the header of a network packet — source IP, destination IP, port, and protocol — and decides whether to allow or block it based on rules. It does not look inside the packet. Deep Packet Inspection goes further: it reads the payload, reconstructs the application-layer stream, and applies security policies to the actual content.

For FortiGate, DPI is the engine behind several critical security features:

• SSL/TLS inspection — decrypts HTTPS, SMTPS, and other encrypted traffic to reveal threats hiding inside certificates.
• Application control — identifies applications by behaviour, not just port (e.g., detecting Teams traffic on port 443 or spotting TOR traffic on non-standard ports).
• Intrusion Prevention System (IPS) — matches payload content against known exploit signatures and anomaly patterns.
• Anti-virus and anti-malware — scans file transfers within HTTP, FTP, SMTP, and other protocols for malicious content.
• Data Loss Prevention (DLP) — detects sensitive data patterns (Aadhaar numbers, PAN cards, SWIFT codes) leaving the network.
• Web filtering — categorises URLs and blocks malicious or policy-violating destinations inside HTTPS sessions.

Without DPI enabled, all of these capabilities are either disabled or severely limited. You are running an expensive next-generation firewall as a basic packet filter.

The Indian Context: Why 2025 Is the Year to Get This Right

Three converging pressures make DPI non-negotiable for Indian enterprises this year.

Encryption Is Now Ubiquitous

Over 95% of web traffic is now encrypted with TLS 1.2 or 1.3. Attackers know this. Command-and-control (C2) infrastructure, ransomware callbacks, and data exfiltration channels are almost universally HTTPS. If your firewall is not decrypting and inspecting that traffic, you are blind to the majority of active threats in your environment. A FortiGate without SSL inspection enabled is, for practical purposes, a firewall with a 95% blindspot.

CERT-In’s 6-Hour Reporting Window Demands Visibility

CERT-In’s 2022 directions — still being actively enforced and refined — require organisations to report certain cybersecurity incidents within six hours of becoming aware of them. You cannot report what you cannot detect. DPI is foundational to the detection layer: it surfaces malware downloads, lateral movement over HTTP, credential harvesting, and C2 traffic that would otherwise be invisible. Organisations without DPI enabled will routinely miss incidents entirely, let alone detect them in time to meet the reporting window.

DPDP Act Compliance Requires Data Awareness

India’s Digital Personal Data Protection Act places obligations on data fiduciaries to safeguard personal data. DLP policies running on top of FortiGate’s DPI engine can detect when Aadhaar numbers, PAN data, or health records are being transmitted outside the organisation — a direct control that helps evidence compliance with the Act’s security obligations. Without DPI, the DLP engine has nothing to inspect.

FortiGate DPI Architecture: What You Are Actually Enabling

FortiGate implements DPI through its Security Profiles framework. Each profile can contain one or more inspection engines. The critical concept is the SSL/TLS Inspection Profile — this is the gateway that actually decrypts encrypted sessions before other engines can see the content.

Inspection Modes

FortiGate offers two primary inspection modes:

• Flow-based inspection — analyses packets as they pass through the FortiGate using pattern matching at wire speed. Low latency, suitable for high-throughput environments. Slightly less thorough for complex evasion techniques.
• Proxy-based inspection — the FortiGate fully reassembles the session (acting as a proxy) before forwarding. Higher latency, but more thorough for detection of evasion, file carving, and complex protocol analysis. Required for full antivirus scanning of large files.

For most Indian enterprise deployments, flow-based is the practical starting point. It provides strong detection coverage with manageable performance overhead and can be tuned over time as your team builds operational familiarity.

A Practical Enablement Checklist for Indian Enterprise Teams

Use this checklist as a starting framework. Actual implementation should be tested in a staging environment or phased rollout before production-wide enforcement.

Phase 1: Inventory and Baseline (Week 1)

• Audit existing FortiGate security profiles: which are applied to which firewall policies?
• Identify all outbound internet-facing policies — these are the highest priority for DPI.
• Check current SSL/TLS inspection profile assignment. In most default configs, it is absent or set to “no-inspection”.
• Review certificate infrastructure: you will need a trusted CA certificate to install on endpoints so SSL inspection does not generate browser warnings. Plan this before enabling.
• Identify any categories that should be excluded from SSL inspection: banking portals, government sites (e.g., income-tax.gov.in, epfo.gov.in), and healthcare applications often have technical or regulatory reasons for exemption.

Phase 2: SSL Inspection Profile Configuration

• Create a custom SSL/TLS inspection profile (do not modify the default “certificate-inspection” profile — it does not decrypt traffic).
• Enable “deep-inspection” mode: this performs full decryption, inspection, and re-encryption.
• Upload your internal CA certificate (or FortiGate’s built-in CA) and push it to endpoints via Group Policy or MDM.
• Configure exemptions for sites where decryption is not appropriate (banking, government, HR portals with employee PII).
• Enable logging for all SSL inspection events — this data is needed for CERT-In log retention compliance.

Phase 3: Security Profile Hardening

• IPS: Apply the “default” IPS signature set to start; tune down to block mode once false positive rate is understood. Enable extended database for higher-risk segments.
• Application Control: Block known evasion tools (TOR, anonymisers, ultrasurf), P2P file sharing (unless operationally required), and remote access tools not on your approved list.
• Web Filtering: Enable FortiGuard Web Filtering and block malicious, phishing, and spam URL categories. For user-facing segments, add policy categories per your acceptable use policy.
• Antivirus: Enable for HTTP, HTTPS, FTP, SMTP, and POP3/IMAP protocols. Set action to “block” for detected malware.
• DLP: Create custom data patterns for Aadhaar format, PAN card format, SWIFT codes, and any organisation-specific data identifiers. Apply to outbound HTTPS policies.

Phase 4: Performance Validation

• Monitor FortiGate CPU and memory utilisation after enabling DPI. SSL inspection is CPU-intensive — validate that hardware models in your deployment have headroom (typically more than 30% free CPU headroom is the target).
• Run throughput tests during off-peak hours to confirm that DPI does not introduce unacceptable latency for latency-sensitive applications (VoIP, video conferencing, ERP transaction processing).
• If performance is constrained, prioritise DPI on segments with highest risk (internet-facing users, guest Wi-Fi, DMZ) and consider hardware refresh or FortiGate model upgrade for high-throughput segments.

Common Mistakes That Make DPI Ineffective

Even organisations that have “turned on” DPI often leave significant gaps. Watch for these:

• SSL inspection enabled but CA not deployed: Users get certificate warnings, IT creates broad exceptions, and the inspection scope shrinks to nearly nothing.
• DPI applied only to one firewall policy: If guest Wi-Fi, server-to-internet, and branch-to-HQ policies do not have DPI profiles, those are your attacker’s preferred paths.
• IPS in detect-only mode permanently: Starting in detect mode is fine; staying there indefinitely means you are logging threats without stopping them. Build a process to review IPS logs weekly and promote to block mode on confirmed signatures.
• Antivirus but no SSL inspection: The antivirus engine cannot scan encrypted files. Malware downloaded over HTTPS is invisible to AV without SSL inspection in place.
• No log retention: CERT-In’s direction requires 180 days of log retention in India. DPI generates substantial logs. Ensure your SIEM or log management system is capturing and retaining them before you enable DPI at scale — otherwise you generate evidence you immediately discard.

How PrahiX Ora Unifies DPI Visibility Across Your Security Operations

Enabling DPI on FortiGate generates the visibility — but visibility only creates value when it feeds into an operations function that can act on it. For organisations managing complex, multi-site, or multi-vendor estates, that operations layer is where the real challenge lies. This is the operational problem that the PrahiX Ora platform addresses. PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks deploys and operates it for clients as their primary field deployment and operations partner.

SIEM — from raw logs to attack storylines: FortiGate DPI generates rich telemetry: IPS hits, web filter blocks, application control events, SSL inspection summaries, DLP triggers. PrahiX Ora’s SIEM layer ingests this alongside logs from other sources — endpoint agents, identity platforms, cloud workloads — and applies correlation rules mapped to the MITRE ATT&CK framework. Rather than surfacing isolated alerts, the platform reconstructs graph-based attack storylines so analysts see the full kill chain, not individual data points. The SIEM supports tiered log retention (hot, cold, and archive tiers), which aligns with CERT-In’s 180-day in-country log retention direction — so the audit trail DPI produces is stored in a form you can present to a regulator.

NMS — seeing the network your DPI runs on: DPI policies are only as effective as the network visibility that underpins them. PrahiX Ora’s Network Management System provides unified observability across FortiGate firewalls, switches, access points, and WAN/SD-WAN links. LLDP/CDP topology discovery maps your estate automatically; ML-based anomaly detection flags unexpected traffic patterns at the network layer before application-layer signatures fire. For enterprises with fragmented multi-vendor NOC visibility — a common situation in Indian IT estates that have grown through acquisitions or organic branch expansion — this single-pane view closes the blind spots between security and operations teams.

Video surveillance (VMS) — physical and network security converged: For manufacturing, retail, and multi-site organisations, physical security and network security have historically been managed by different teams with different tools. PrahiX Ora’s video surveillance (VMS) module supports ONVIF, Hikvision, and Dahua camera management with integrated video analytics, bringing it into the same operations view as network and security events. When a DPI alert fires on the network simultaneously with a physical access anomaly at a server room, operators see both in context rather than correlating across two separate systems after the fact.

SOAR — meeting the CERT-In 6-hour window: A DPI alert that surfaces an active intrusion at 2 AM on a Friday sets a clock running. CERT-In’s 6-hour reporting window is unforgiving. PrahiX Ora’s SOAR layer includes pre-built playbooks and connectors — including direct integration with FortiGate — that automate the initial response: pushing blocklists, isolating sessions, quarantining endpoints, and generating the incident timeline needed for regulatory notification. Without this automation, meeting the 6-hour window consistently across all incident types requires a manual effort that most security teams cannot sustain.

For organisations that want the full FortiGate DPI value chain — configured correctly, monitored continuously, and operationally supported around the clock — PJ Networks offers managed deployment and operations of PrahiX Ora alongside our managed FortiGate service. Reach out to discuss what a deployment would look like for your estate.

Conclusion: DPI Is Not Optional in 2025

Deep Packet Inspection is not a premium feature to evaluate in the next budget cycle — it is the baseline that makes every other FortiGate security capability functional. In a threat landscape where attackers default to encrypted channels and Indian regulators are actively enforcing incident reporting and data protection obligations, running a next-generation firewall without DPI enabled is the equivalent of installing a CCTV system with the lens cap on.

The good news is that FortiGate makes DPI achievable — the capabilities are already licensed in most enterprise deployments. What most organisations need is not a new product purchase but a structured enablement project, operational processes to act on what DPI surfaces, and a 24/7 operations function to turn visibility into response.

If your team needs a DPI readiness assessment, help configuring SSL inspection profiles, or a fully managed FortiGate and SOC service, speak with the PJ Networks team. We work with Indian enterprises across manufacturing, BFSI, healthcare, and retail to move from firewall ownership to firewall effectiveness.