NTurbo creates a special data path to redirect traffic from the ingress interface to the IPS engine, and from the IPS engine to the egress interface.

Also, advanced mode supports nested or inherited groups; that is, users can be members of subgroups that belong to monitored parent groups.
In advanced mode, you can configure FortiGate as an LDAP client and configure the group filters on FortiGate. You can also configure group filters on the collector agent.

The output shows that one server was contacted to retrieve FortiGuard contract information, as indicated under "Service : Web-filter" with "License : Contract" and "Num. of servers : 1." The entry "Default servers : Included" confirms that FortiGate is using the default FortiGuard communication settings, meaning it communicates directly with Fortinet's public FortiGuard servers instead of a custom or local override.

When a certificate fails for any of the reasons above, you can configure any of the following actions:
* Keep Untrusted & Allow: FortiGate allows the website and lets the browser decide the action to take.
FortiGate takes the certificate as untrusted.
* Block: FortiGate blocks the content of the site.
* Trust & Allow: FortiGate allows the website and takes the certificate as trusted.

In an AWS Cloud-Native Firewall deployment, EC2 traffic is routed through the Gateway Load Balancer endpoint (GWLBe), which forwards the traffic to the FortiGate CNF for inspection. After processing, the FortiGate CNF sends the traffic out to the Internet Gateway (IGW) to reach the internet.