Meridian Electric Cooperative's NOC wants to block objectionable video content for staff browsing over HTTPS, in addition to their existing Web Filter profile. How should the administrator configure this in FortiOS 7.6, and what does it require to act on the HTTPS sessions?
Select an answer to reveal the explanation.
Short Explanation
Video Filter in FortiOS isn't a checkbox buried inside Web Filter — think of it like a second bouncer standing next to the first one at the same door. You apply it as its own security profile on the policy, right alongside Web Filter, and if the traffic is HTTPS, that bouncer needs the session decrypted to actually see what's playing.
Full Explanation
Video Filter is a standalone security-profile object in FortiOS 7.x, the same way DNS Filter and Application Control are — it is not a sub-feature nested inside a Web Filter profile. To enforce it, the administrator creates a Video Filter profile and attaches it to the firewall policy in addition to the Web Filter profile; both act on the same traffic independently. Because video streams overwhelmingly run over HTTPS, Video Filter can only categorize and act on that content if the session is decrypted, which means the policy also needs SSL (deep) inspection enabled — without it, the profile has no plaintext content to evaluate. The option describing video filtering as an automatic sub-feature of Web Filter is wrong by design: FortiOS keeps these as separate profile objects with separate configuration, precisely so each can be enabled, tuned, or omitted independently. Adding video sites to the static URL filter list is a coarse, per-domain workaround that blocks whole sites rather than performing the content-aware video categorization Video Filter is built for, and it sidesteps the actual feature being asked about. Relying on FortiGuard category ratings alone conflates web-category filtering, which judges whole sites, with video-specific content control, which is a different profile entirely. A caveat: if SSL inspection is only set to certificate inspection rather than full SSL inspection, Video Filter still won't see enough of the session to categorize video content — confirm the policy's SSL/SSH inspection profile is set to deep inspection when video blocks aren't taking effect.