Troubleshooting Tip: Unable to access Dropbox while blocking File Sharing category

Description

This article discusses an issue where Dropbox fails to load properly (e.g., broken UI or missing elements) when the File Sharing category is blocked via Web Filter. This behavior occurs despite allowing Dropbox-specific domains using wildcard FQDNs.

The root cause lies in how Dropbox delivers content through multiple dynamic domains and third-party CDNs that are difficult to account for manually.

Scope

FortiGate.

Solution

Dropbox relies on several dynamic subdomains and third-party CDNs (e.g., dropbox.com, dropboxapi.com, dropboxusercontent.com, akamai.net, etc.), which are not effectively handled using wildcard FQDN entries. These domains are officially documented at Dropbox's domain reference page:
What official domains does Dropbox use?

Manually managing all possible domains is not scalable, and wildcard entries may not cover every required endpoint for full Dropbox functionality.

To ensure Dropbox access while blocking other file-sharing services, configure the following firewall policies in the correct order:

1. Allow Dropbox using ISDB: Use the Internet Service Database to identify Dropbox traffic, which automatically includes associated CDN domains.

2. Block other file-sharing applications: Apply a Web Filter profile to block the File Sharing category. This policy must be placed below the Dropbox ISDB policy.

3. Ensure the Web Filter profile is configured to block the File Sharing category to effectively prevent access to all other file-sharing applications.

Note:
dopbox.com is exempted from default SSL/SSH Inspection list, please remove it to be inspected by FortiGate.