FortiGate NGFW Deep Packet Inspection: Stopping Encrypted Threats Before They Reach Your Network

• 26 July, 2026
• No Comments

More than 90 per cent of malware now communicates over encrypted channels. For Indian enterprise security teams, that statistic is not an abstraction—it is a daily operational problem. When attackers wrap their command-and-control (C2) traffic, data-exfiltration payloads, and dropper downloads inside TLS, a firewall that only reads packet headers is effectively blind. Deep Packet Inspection (DPI) on a next-generation firewall (NGFW) is the primary surgical instrument that restores that visibility. This post walks through how FortiGate DPI works, why it matters for Indian regulatory compliance, common deployment pitfalls, and how PJ Networks and the PrahiX Ora platform deliver it as a managed, always-on capability.

Why Encrypted Threats Are the Dominant Attack Surface Today

The shift toward encrypted malware is driven by simple attacker economics. TLS certificates are free. Most enterprise inspection points—legacy firewalls, basic IDS sensors, even many cloud gateways—cannot or do not decrypt and re-inspect traffic. Attackers know this and exploit the blind spot systematically.

In the Indian context, several threat patterns have become routine:

• Encrypted C2 beaconing — Remote Access Trojans (RATs) and sophisticated loader families check in via HTTPS, making the traffic indistinguishable from normal browser activity at the packet level.
• TLS-wrapped ransomware staging — Initial-access brokers deliver first-stage downloaders over HTTPS from compromised cloud storage buckets or attacker-controlled CDN origins, then fetch the ransomware payload through the same channel.
• Business Email Compromise (BEC) lateral movement — After compromising an email account, threat actors use encrypted API calls to Microsoft 365 or Google Workspace to exfiltrate contacts, calendar data, and financial records.
• Supply-chain update hijacking — Legitimate software updaters that pull over HTTPS can be redirected to attacker infrastructure via DNS manipulation or BGP hijacks—scenarios seen in several high-profile incidents globally.

Without SSL/TLS inspection, your firewall sees only the TLS handshake metadata—SNI hostname and certificate issuer—not the payload. Deep Packet Inspection restores full payload visibility by acting as a transparent TLS proxy inside the network perimeter.

How FortiGate NGFW Implements Deep Packet Inspection

FortiGate’s DPI engine operates at multiple layers simultaneously. Understanding those layers is essential for any architect planning a deployment.

SSL/TLS Inspection (Proxy-Based Decryption)

FortiGate intercepts outbound TLS sessions in one of two modes:

• Full SSL Inspection — FortiGate terminates the client-side TLS session, decrypts the payload, inspects it against all enabled security profiles (IPS, antivirus, web filtering, DNS filtering, application control), then re-encrypts and forwards to the destination server. The FortiGate’s CA certificate must be trusted by endpoints—typically deployed via Group Policy or MDM.
• Certificate Inspection — A lighter mode that validates the server certificate chain without decrypting payload. Useful for financial or HR applications where full decryption raises privacy concerns, but it cannot inspect payload content.

For inbound inspection (protecting published applications), FortiGate supports deep inspection on reverse-proxy flows, enabling the WAF and IPS engines to inspect encrypted traffic destined for internal web servers.

Application Identification and Control

FortiGate’s Application Control engine uses a combination of protocol decoders, behavioral heuristics, and FortiGuard’s threat-intelligence feed to identify applications even when they use non-standard ports or attempt to masquerade as HTTPS. This is how the platform distinguishes legitimate Microsoft Teams traffic from a threat actor using a Teams-look-alike C2 framework.

Intrusion Prevention System (IPS) on Decrypted Traffic

Once TLS is terminated, the IPS engine evaluates each decrypted stream against a signature library that Fortinet updates multiple times per day via FortiGuard. Signatures cover exploit kits, vulnerability-specific shellcode patterns, and behavioral indicators like beaconing cadence and encoded command-strings typical of known RAT families.

FortiSandbox Integration for Unknown Payloads

For files and attachments traversing the firewall—PDFs, Office documents, executables—FortiGate can forward samples to FortiSandbox (on-premises or FortiCloud) for dynamic detonation. The sandbox executes the sample in an isolated VM, observes runtime behavior, and returns a verdict. Only clean files proceed; suspicious ones are quarantined and an alert is raised.

Deployment Considerations for Indian Enterprise Environments

DPI deployments are not plug-and-play. Several India-specific factors shape the architecture:

Certificate Trust Rollout

Full SSL inspection requires endpoints to trust the FortiGate’s CA certificate. In large Indian enterprises—especially those running mixed Windows/Linux/mobile fleets across multiple offices—this rollout must be coordinated through Active Directory GPO, Intune, or mobile device management. Failures here cause browser certificate errors that users interpret as “the internet is broken,” generating support tickets and pressure to disable inspection.

Best practice: Stage the rollout department by department. Start with IT and security teams, validate, then expand. Use FortiGate’s SSL exemption list to exclude known-problematic destinations (banking applications that use certificate pinning, government portals with self-signed certificates) rather than disabling inspection globally.

Performance Sizing

DPI is CPU and memory intensive. A FortiGate sized for 10 Gbps firewall throughput may deliver 2–3 Gbps under full SSL inspection load. Indian organisations running multi-gigabit internet uplinks must size hardware with DPI-specific throughput figures from the FortiGate datasheet, not the headline firewall throughput. FortiGate models with dedicated NP (Network Processor) and CP (Content Processor) ASICs offload much of this work from the main CPU.

Privacy and Regulatory Exemptions

Under the Digital Personal Data Protection (DPDP) Act 2023, intercepting and logging personal data—including email content flowing over TLS—carries compliance obligations. Organisations should:

• Define an explicit SSL inspection policy in their data-processing agreements and employee acceptable-use policies.
• Exempt personal banking, medical portals, and HR SaaS applications from full inspection using FortiGate’s URL category-based exemption lists.
• Ensure inspection logs are retained per CERT-In’s 180-day in-country log retention directive, but that personal data within those logs is handled under appropriate access controls.

Handling Certificate-Pinned Applications

Mobile applications and some enterprise software pin their server certificates, meaning they will reject a FortiGate re-signed certificate and fail to connect. The correct response is to add these destinations to the SSL exemption list—not to disable DPI globally. Common pinned destinations include corporate MDM agents, some banking apps, and selected Google services.

PrahiX Ora: Unified SecOps Visibility for DPI-Generated Alerts

Deploying FortiGate DPI generates a significant volume of security events—IPS triggers, malware detections, anomalous application usage, and SSL handshake anomalies. Without a platform to ingest, correlate, and prioritise those events, alert fatigue sets in and genuine threats are buried in noise. This is the operational gap that the PrahiX Ora unified SecOps platform addresses—a platform we deploy and operate for clients as PJ Networks’ primary field operations partner for PrahiX Tech Pvt Ltd.

SIEM: Correlation and Retention at Compliance Scale

Ora’s SIEM module ingests FortiGate logs alongside events from endpoints, Active Directory, cloud workloads, and SaaS platforms. Correlation rules mapped to MITRE ATT&CK tactics—such as detecting a TLS DPI alert followed by an unusual outbound DNS query from the same host within minutes—are surfaced as a single graph-based attack storyline rather than isolated log lines. This is precisely the kind of multi-source correlation that helps analysts meet CERT-In’s 6-hour incident reporting window: the storyline is already built by the time the analyst opens the ticket.

Tiered retention (hot, warm, and archive storage) supports CERT-In’s direction on 180-day in-country log retention without requiring organisations to budget for hot-storage at full volume for all six months.

NMS: Network Observability Where NOC Visibility Is Fragmented

Indian enterprise estates are typically multi-vendor—FortiGate firewalls alongside Cisco or Juniper switches, Aruba or Ruckus wireless, and mixed WAN/SD-WAN links from multiple ISPs. Ora’s Network Management System module delivers unified observability across this entire estate using LLDP/CDP topology discovery and ML-based anomaly detection. When a DPI-triggered block causes an application path to fail, the NMS correlates the firewall event with network path telemetry, giving the NOC team an immediate causal chain rather than separate console silos.

Video Surveillance (VMS): Physical and Network Security Under One Operations View

For manufacturing, retail, and multi-site Indian enterprises, physical and network security increasingly need to be viewed together. Ora’s video surveillance (VMS) module manages ONVIF/Hikvision/Dahua cameras alongside network devices, supporting video analytics for perimeter events. When a physical-access anomaly coincides with a network DPI alert—for example, an after-hours physical entry followed by an encrypted lateral-movement attempt—the combined view in a single operations console dramatically shortens investigation time. This is particularly relevant for facilities covered under DPDP Act data-localisation requirements where physical and logical access to personal data must be jointly audited.

SOAR: Automated Response Within the CERT-In 6-Hour Window

Meeting CERT-In’s mandatory 6-hour reporting requirement for cybersecurity incidents is operationally demanding without automation. Ora’s SOAR module provides pre-built playbook connectors that push blocklists directly to FortiGate the moment a confirmed threat indicator is identified—no human clipboard needed between the SIEM alert and the firewall enforcement point. A typical automated response sequence: DPI detects C2 beacon → Ora SIEM correlates with EDR telemetry → SOAR playbook queries threat-intel feed → confirmed malicious IP is pushed to FortiGate blocklist and the endpoint is quarantined from NAC → incident ticket is auto-drafted with evidence for the CERT-In report. Automation is what makes a 6-hour window realistic at enterprise scale.

Common DPI Misconfigurations That Create False Security

In our managed deployments, we consistently encounter the same set of misconfigurations that leave enterprises believing they have DPI coverage when significant gaps remain:

• SSL inspection enabled on policy but exemption list is too broad — A “start small” exemption list that was never trimmed ends up exempting 60–70% of internet traffic. Regularly audit and justify every exemption.
• IPS in detect-only mode indefinitely — IPS deployed in detect mode during testing and never switched to block mode. Alerts appear in logs but no traffic is stopped.
• Outdated FortiGuard subscription — FortiGate DPI is only as good as its signature database. An expired or lapsed FortiGuard subscription means the IPS, antivirus, and application-control engines are running on stale intelligence.
• No inspection on east-west traffic — DPI applied only at the internet perimeter but not on inter-VLAN or east-west traffic. Once an attacker is inside the network, lateral movement proceeds uninspected.
• Logging disabled or set to local disk only — Logs stored only on the FortiGate’s local disk are overwritten quickly and are lost if the device is reimaged or replaced. All security logs must flow to a SIEM.

Implementation Checklist: FortiGate DPI for Indian Enterprises

Use this checklist when planning or auditing a FortiGate DPI deployment:

• ☐ Hardware/VM sized for DPI throughput (not headline firewall throughput) at peak load
• ☐ FortiGate CA certificate deployed to all managed endpoints via GPO/MDM
• ☐ Full SSL inspection enabled on internet-bound policies for corporate device categories
• ☐ Certificate inspection (not full) applied to BYOD/guest policies where warranted
• ☐ SSL exemption list documented, justified, and reviewed quarterly
• ☐ IPS profile set to block mode (not detect-only) for internet and DMZ policies
• ☐ FortiGuard subscription active and auto-updating
• ☐ Application control profile configured with appropriate categories blocked
• ☐ FortiSandbox (cloud or on-prem) enabled for file inspection
• ☐ DPI applied to east-west inter-VLAN traffic, not only north-south
• ☐ All security logs forwarded to SIEM (not local disk only)
• ☐ DPDP-sensitive application categories added to SSL exemption list with documentation
• ☐ CERT-In 180-day log retention policy enforced at SIEM layer
• ☐ Incident response runbook updated to include DPI-triggered alert escalation paths

How PJ Networks Delivers Managed FortiGate DPI

PJ Networks designs, deploys, and operates FortiGate NGFW environments for Indian enterprises as part of our managed security services portfolio. Our standard DPI engagement includes:

• Architecture review and sizing — We evaluate your current internet egress, inter-VLAN traffic volumes, and application mix to right-size FortiGate hardware or VM instances for DPI workloads.
• Certificate trust rollout support — Our engineers work with your AD/Intune teams to deploy the FortiGate CA certificate across your endpoint fleet without disrupting users.
• Policy design and tuning — We build SSL inspection policies, IPS profiles, and application control profiles aligned to your business requirements and DPDP Act obligations.
• 24/7 NOC/SOC monitoring — Our operations centre monitors DPI-generated alerts around the clock, correlating firewall events with endpoint and identity telemetry through the PrahiX Ora platform.
• CERT-In compliance support — Our managed service includes the documentation and log-retention infrastructure needed to evidence compliance with CERT-In’s reporting and retention directives.

If your organisation is running FortiGate firewalls without full SSL inspection enabled, or if DPI alerts are flowing into a console that no one actively monitors, you are carrying more risk than your firewall investment should allow. Speak with our team to assess your current DPI coverage and close the gaps before the next encrypted threat reaches your critical systems.