Skip to main content
sfernando
Staff
sfernando
Staff
May 19, 2026

Technical Tip: AI websites not working after applying warning page in web filter

  • May 19, 2026
  • 1 reply
  • 116 views

Description

This article describes an issue experienced by AI sites when action is selected as a warning and an overide replacement message is set.

Scope

FortiGate.

Solution

FortiGate has been configured so that when accessing AI sites, a warning will pop up, and when the 'proceed' button is pressed, users can access the AI site. Even though the AI sites were accessible, users could not use the AI sites and search for anything required. In this article, 'chatgpt.com' and 'copilot.microsoft.com' are considered as examples. Answers to the question raised are not seen, and sometimes an error is displayed. Refer to the video below:



In forward traffic logs, security events logs, it is observable that traffic is passed with out been blocked.


a85591d7.png


Below is the config that is causing this issue:


config webfilter profile
   edit "GenAI_sites"
      set comment "warning pop up for AI"
      set feature-set proxy
      set replacemsg-group "AIWebsites"
      config ftgd-wf
         unset options
         set exempt-quota g21
         config filters
            edit 142
            set category 142
            set action warning
            set warn-duration 2s <<<<<<<<<<<
            set override-replacemsg "GENAI_sites"
         next


The 'warn-duration' is set as 2 seconds, where the warning keeps appearing every 2 seconds. But the AI tools are not fully loaded during this time, and when accessing the content or when trying to get a reply to this disrupt the traffic and the AI sites malfunction.

To avoid this issue, increase the 'warn-duration' at least to 5 minutes, which is the default.


config filters
            edit 142
            set category 142
            set action warning
            set warn-duration 5m <<<<<<<<<<<
            set override-replacemsg "GENAI_sites"
         next


Note: It is necessary to understand 'warn-duration' parameter controls when the next warning will pop up. If it is set to 5 minutes, after the initial warning pops up, it is possible to access the sites in the given category ( in this example ChatGPT and Copilot) until the next warning pops up in 5 minutes.

    1 reply

    M
    Mohsin01
    New Member
    May 19, 2026

    This is a fairly common configuration interaction that catches people out. The warning page mechanism in the FortiGate web filter requires an active SSL inspection profile to actually intercept and inject the warning page into HTTPS traffic. If SSL inspection is not enabled or is set to certificate inspection only rather than deep inspection, the FortiGate cannot modify the response stream to insert the warning page, so it defaults to blocking the connection entirely instead of presenting the warning.

    It's worth checking the firewall policy attached to the web filter profile to confirm deep SSL inspection is active for the traffic hitting those AI site categories. Also verify that the FortiGate CA certificate is deployed and trusted on the client machines because even with deep inspection correctly configured an untrusted CA will cause the browser to reject the substituted certificate before the warning page renders.

    Another thing worth checking is whether the AI website categories are being matched by a more restrictive filter rule higher in the policy order that is blocking before the warning page rule has a chance to apply. Policy ordering catches a lot of these scenarios where the intended behavior is configured correctly but never actually reached.

    Did the issue appear across all AI site categories simultaneously or only in specific ones? Because that pattern usually points to either a category mapping issue or a policy ordering conflict rather than the warning page configuration itself.

    Terms & ConditionsAccessibility statement