With flow-based inspection, NTurbo improves antivirus performance by establishing a dedicated fast data path that redirects traffic between the IPS engine and the FortiGate ingress/egress interfaces. This reduces CPU overhead, allowing antivirus scanning to happen at higher throughput without requiring full proxy-based buffering.

With the Server certificate SNI check set to Strict, FortiGate enforces that the SNI must match either the Common Name (CN) or Subject Alternative Name (SAN) in the server certificate; otherwise, it closes the connection.

NTurbo enhances flow-based inspection performance by creating a fast data path between the IPS engine and the ingress/egress interfaces. This allows traffic to be inspected efficiently without needing to pass through the slower, traditional packet path, thus reducing CPU load and improving throughput during flow-based security inspections.

When flow-based inspection is used, FortiGate scans packets as they flow through, and if a virus is detected, the connection is reset immediately. Because the infected file is blocked mid-transfer, the user does not receive a block replacement message - only the last packet is dropped to terminate the connection.
Replacement messages are shown only in proxy-based inspection, where FortiGate can buffer and fully analyze the file before sending a response page.