Skip to main content
ssavin
Staff
ssavin
Staff
June 22, 2023

Technical Tip: The difference between 'Allow' and 'Exempt' in the Web Filter URL filter

  • June 22, 2023
  • 0 replies
  • 43832 views
Description

 

This article describes the difference between the actions 'Allow' and 'Exempt' under the URL filter in the Web Filter Profile.

 

Scope

 

FortiGate, FortiOS.

 

Solution

 

A URL is evaluated by the web filter profile in the following order:

  1. URL filter.
  2. FortiGuard Web Filter (FortiGuard categories).
  3. Web content filter.
  4. Web script filter.
  5. Antivirus scan.

 

image (46) (1).png

 

The actions that are available for URL filter application are:

  1. Exempt.
  2. Block.
  3. Allow.
  4. Monitor.

 

The 'Exempt' action for a defined URL/Wildcard/RegEx entry in the URL filter will permit the traffic to pass through the firewall without any further scanning. There will be no match against FortiGuard web filters (FortiGuard categories), Web Content Filter, and so on. 

 

Note: This configuration does not exclude traffic from inspection by other security features, including Application Control, Antivirus, or DNS Filtering.
 

Security profiles intended to be bypassed can be defined in the CLI by running the following commands:

 

config webfilter urlfilter

    edit 1
        set name "Auto-webfilter-urlfilter_rmpau71ya"
            config entries
                edit 1
                    set url "fortinet.com"

                    set action exempt

                    set exempt ?         <----- Use ? to see available options. Multiple options can be selected, separated by spaces.
av                     AntiVirus scanning.
web-content            Web filter content matching.
activex-java-cookie    ActiveX, Java, and cookie filtering.
dlp                    DLP scanning.
fortiguard             FortiGuard web filtering.
range-block            Range block feature.
pass                   Pass single connection from all.
antiphish              AntiPhish credential checking.
all                    Exempt from all security profiles.
                next
            end
    next
end

 

The 'Block' action for a defined URL/Wildcard/RegEx entry in the URL filter will block any further traffic to a specified URL.

 

The 'Allow' action for a defined URL/Wildcard/RegEx entry in the URL filter will permit the firewall to continue scanning against FortiGuard Web Filter (FortiGuard categories). If the FortiGuard web filter allows the traffic for that URL, the scanning will continue to be done by the web content filter and so on.

 

The 'Monitor' action for a defined URL/Wildcard/RegEx entry in the URL filter will have the same effect as the action 'Allow', but the traffic will be logged.


If the configuration requirement is to permit access for a certain URL defined under a URL filter that falls under a blocked FortiGuard web filter, then the correct action to choose needs to be exempt. If the allow action is used only, then the URL will be allowed by the URL filter but will be blocked by the FortiGuard web filter.

 

The use case scenario for using the 'Allow' action in the URL filter is to allow only certain subdomains or domains and block everything else in the restrictive environments.

 

Allow action.png

 

Note: Starting from FortiOS v7.6.3, this option is also available via GUI:


urlfilter1.jpg

 

urlfilter.jpg

 

When 'exempt' is selected, the option to specify which security inspections to bypass (such as AntiVirus, DLP, FortiGate Cloud, and Legacy filter) becomes available.

      Terms & ConditionsAccessibility statement