Block AI Apps on FortiGate

Every organization now has to decide which generative AI tools people may use at work, and the firewall is a natural place to enforce that decision. A FortiGate can do it with security profiles you already know: web filtering and application control, backed by SSL deep inspection. Here is how to block AI apps on FortiGate, keep the AI tool your company has approved, and where the firewall's control ends.

Two profiles, two ways to recognize AI

FortiGuard classifies AI services in two places, and a solid policy uses both.

• The web filter has an Artificial Intelligence Technology category, category 100 in the CLI. It sorts websites by what they offer, so it covers AI sites as soon as FortiGuard has rated them.
• Application control has a Generative AI category, category 36 in the CLI, in current FortiOS versions. It recognizes the applications themselves by their traffic signatures, including services such as ChatGPT.

The two overlap on purpose. A new AI site may be rated by the web filter before an application signature exists, and application control can recognize specific actions inside a service, such as posting a prompt to ChatGPT. Blocking in both profiles closes the gaps between them.

Block the AI category in the web filter

In Security Profiles > Web Filter, create a profile or edit the one your Internet policy uses. In the category table, find Artificial Intelligence Technology under General Interest - Business and set its action to Block.

To check that it works, apply the profile to a firewall policy and open FortiGuard's test page for the category, https://wfurltest.fortiguard.com/wftest/100.html, from a client behind it. You should see the FortiGate's block page, and an entry in Log & Report > Security Events > Web Filter. If you are unsure how a particular AI service is rated, look it up with the FortiGuard Web Filter Lookup before you rely on the category.

Block the Generative AI category in application control

In Security Profiles > Application Control, create a sensor and set the Generative AI category to Block. If you want to see what is in use before you block anything, set it to Monitor first and read the logs for a few days.

To see which applications the category contains on your FortiGate, list them in the CLI by category ID:

get application name status | grep 'cat-id: 36' -B3

Fortinet notes two conditions for the AI application database to stay current. At least one firewall policy has to use an application control profile, and the FortiGate needs a valid firmware and general updates (FMWR) contract. If the database never updates, the category matches less and less over time.

Use deep inspection, or the FortiGate sees very little

AI services run over HTTPS. With certificate inspection only, the FortiGate sees the server name but not what happens inside the connection. Some Generative AI signatures still work that way, but others require SSL deep inspection. Fortinet shows which ones in the signature details: in Security Profiles > Application Signatures, hover over a Generative AI signature and check its Requirements field.

Two more settings matter here. Fortinet's own examples block QUIC in application control, so browsers fall back to regular HTTPS that the FortiGate can inspect. And with extended logging enabled, application control logs can include details such as the AI model, the user, and the prompt itself. That is useful for an investigation, but it also means your logs now hold whatever people typed, so treat them as sensitive data.

Keep the AI tool your company approved

Firewall policies are evaluated from top to bottom, and the first match wins. That gives you a simple exception. Create an FQDN address for the approved AI service, add it as the destination of a policy for the users who may use it, and place that policy above your general Internet policy. Give it profiles that don't block the AI categories, while the general policy below keeps blocking them for everyone else.

Use the hostname the service actually runs on. Many AI providers keep their information site and the AI tool on different hostnames, and you want the second one.

Where the firewall stops

Everything so far decides which AI apps people can reach. It doesn't control what they type into the app you allow. For that, FortiGate DLP (Data Loss Prevention) can inspect uploads to AI services with deep inspection and block messages and files that contain sensitive keywords or patterns. Fortinet's example uses a proxy-based policy with a DLP dictionary, and its documentation is honest about the limit: AI web apps change often, so DLP improves protection but isn't foolproof. For stronger protection, its advice is to restrict access to the AI service altogether.

Conclusion

To block AI apps on FortiGate, block the Artificial Intelligence Technology category in the web filter and the Generative AI category in application control, and apply both to a policy with deep inspection. Put a policy for your approved AI tool above them, check the result with FortiGuard's test page and the security logs, and add DLP if you need to control what goes into the tools you allow. If you also run Palo Alto Networks firewalls, the same approach is covered in our post Block AI Apps on Palo Alto Firewall.

Relevant Training

Inspection modes, application control, and web filtering are covered in Advanced Traffic Control with FortiGate, and firewall policies and objects in Traffic Control with FortiGate, both with hands-on Virtual Labs.