02-防火墙策略全解.ppt

The diagram above illustrates that an overall policy for content inspection is not a typical scenario. FortiGates are able to apply varying content inspection technologies based on different communications through the network. For example, sessions originating from the internal network may not be subject to IPS scanning. Whereas sessions entering servers on the DMZ should be subject to IPS scanning. We may wish to employ web content inspection technologies for our internal network, however, our servers may communicate with any outside host without such inspection. Protection profiles are b