FortiGate's IPS protocol decoders analyze network transmission patterns and application signatures to identify and block malicious traffic. Application Control is the feature that allows FortiGate to detect, classify, and block applications based on their behavior and signatures, even when they do not rely on traditional URLs.
# Application Control works alongside IPS protocol decoders to inspect packet payloads and enforce security policies based on recognized application behaviors.
# It enables granular control over non-URL-based applications such as P2P traffic, VoIP, messaging apps, and other non-web-based protocols that IPS can identify through protocol decoders.
# IPS and Application Control together can detect evasive or encrypted applications that might bypass traditional firewall rules.

The packet capture output displays a TLS Client Hello message from FortiGate to FortiManager Cloud. This message contains Server Name Indication (SNI), which is used to indicate the domain name that FortiGate is trying to connect to.
FortiGate will receive a certificate that supports multiple domains because FortiManager operates in a cloud computing environment.
FortiManager Cloud hosts multiple customers and domains under a shared infrastructure. The TLS handshake includes SNI (Server Name Indication), which allows FortiManager Cloud to serve multiple certificates based on the requested domain. This means FortiGate will likely receive a multi-domain or wildcard certificate that can be used for multiple customers under FortiManager Cloud.
The wildcard for the domain .fortinet-ca2.support.fortinet.com must be supported by FortiManager Cloud.
The SNI extension contains the domain 9398.support.fortinet-ca2.fortinet.com.
FortiManager Cloud must support wildcard certificates such as *.fortinet-ca2.support.fortinet.com to securely manage multiple subdomains and customers.
This ensures that FortiGate can validate the server certificate without any TLS errors.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
By default, FortiGate ' s SSL/SSH Inspection profile is configured to recognize and inspect HTTPS traffic on the standard port 443. To inspect HTTPS traffic on a non-standard port , such as 8443 , the administrator must modify the protocol-to-port mapping within the security profile.
In the SSL/SSH Inspection configuration (accessible via Policy & Objects > Security Profiles), there is a section for " HTTPS " where additional ports can be specified. By adding 8443 to this list alongside 443, the FortiGate ' s inspection engine (IPS and UTM) is instructed to apply SSL decryption and analysis to any traffic using port 8443 as if it were standard HTTPS traffic. Without this mapping, the firewall would treat the traffic as an unknown encrypted protocol and would not be able to perform deep content analysis.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
In an enterprise architecture, LAN interface connections on a FortiGate (particularly for Internal Segmentation Firewalls or Data Center Firewalls) typically utilize two key technologies for connectivity and management:
* 802.3ad (Aggregate Interfaces): To provide redundancy and high-speed data transfer, firewalls connect to multiple physical switches using 802.3ad link aggregation, combining multiple physical interfaces into a single logical interface.
* FortiLink: This is the proprietary protocol used for the management of FortiSwitch units by the FortiGate unit. When the LAN connection is to a FortiSwitch, FortiLink is used to extend the FortiGate
' s control over the switch ports as if they were local ports on the firewall itself.