Troubleshooting Tip: Web Filter Category shows 'allow' in the GUI but shows 'monitor' in the CLI
Description
This article describes unexpected behavior of the CLI configuration on a custom Category or Local Category where 'set allow' cannot be configured.
Scope
FortiGate.
Solution
The Custom Category testcat Action is set to Allow. 
In the GUI: Security Profiles -> Web Filter -> Select Web Filter Profile.
 
In the CLI:
get webfilter categories | grep testcat
144 testcat
show full webfilter profile TEST_WF | grep 144 -A2
set category 144
set action monitor
set log disable
The Custom Category testcat Action is set to Monitor:
In the GUI: Security Profiles -> Web Filter -> Select Web Filter Profile.
 
In the CLI:
get webfilter categories | grep testcat
144 testcat
show full webfilter profile TEST_WF | grep 144 -A2
set category 144
set action monitor
set log enable
There is no 'set action allow' in the CLI. This is expected behavior. If the custom category is set to Allow in the GUI, the Web Filter will allow the traffic without logs. Instead, the action for log command is changed based on whether category is allowed or monitored. See Technical Tip: Explanation of the Allow, Block, Exempt, and Monitor static URL filter actions for more information.
set action ?
block Block access.
authenticate Authenticate user before allowing access.
monitor Allow access while logging the action.
warning Allow access after warning the user.
Related articles:
