Fortinet Docs: Monitor YouTube Traffic with FortiView and SSL Inspection

October 28, 2026 Rachel Kim – Technology Editor Technology

FortiGate FortiOS 8.0.2 Deploys YouTube Traffic Monitoring with SSL Deep Inspection

Network administrators can monitor network traffic for YouTube using FortiView Applications view with SSL deep inspection, according to Fortinet documentation. The setup process requires creating a firewall policy where Application Control is enabled, SSL inspection is set to deep-inspection, and log allowed traffic is set to all sessions.

  • Admins can deploy either deep SSL inspection for granular signature tracking or standard application sensors without decrypting payload traffic.
  • Logs are centralized directly into FortiView Applications view and Security Events for real-time monitoring and session drilldowns.

Configuring Security Profiles and Application Sensors in FortiOS 8.0.2

To capture specific user interactions with the video platform, engineers must go to Security Profiles and then Application Control within the FortiGate management interface. Because YouTube cloud applications fall under the Video/Audio category, administrators need to ensure that category is explicitly monitored, which is indicated by an eye icon in the profile settings. Selecting View Application Signatures lets operators inspect individual sensors like YouTube_Video.Access and YouTube_Channel.ID before pushing policies to production.

config firewall policy
    edit 1
        set name "Monitor_YouTube"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "HTTPS" "HTTP"
        set utm-status enable
        set application-control "default"
        set ssl-ssh-profile "deep-inspection"
        set logtraffic all
    next
end

Unique IDs Track Specific YouTube Application Signatures

The documentation outlines several distinct application signatures tied to unique IDs for granular reporting. For instance, attempting to watch high-definition video triggers YouTube_HD.Streaming under ID 33104, while uploading content registers as YouTube_Video.Upload under ID 22564. Basic access without deep inspection relies on the generic YouTube sensor with ID 31077, which functions independently of SSL decryption profiles. Testing these rules involves playing media on a test workstation and reviewing the output under Log & Report, Security Events, and Application Control.

Drilling Down via FortiView Applications View

Once traffic flows through the active firewall policy, administrators can access Dashboard, FortiView, and Applications to inspect aggregate bandwidth usage. Double-clicking the YouTube entry reveals drilldown metrics where operators can view session logs to verify that specific application IDs like YouTube_Video.Play (ID 38569) are correctly tagging user sessions.

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.

Related reading