Troubleshooting Tip: Web rating override is not taking effect after upgrading to v7.2.11, v7.4.6 ,v7.4.7, v7.6.1 ,and v7.6.2

Description

This article describes how to fix if the web rating override on a Web Filter profile is broken with the configured action after an upgrade to v7.2.11, v7.4.6, v7.4.7, v7.6.1, and v7.6.2.

Scope

FortiGate v7.2.11, v7.4.6, v7.4.7, v7.6.1, v7.6.2 with flow-based web filter.

Solution

Custom category:

Web filter profile:

Firewall policy:

When accessing the website (doh.dns.apple.com), the FortiGuard Block Page is encountered. The website category should be 'Allowed_Custom'.

This issue only affects firewall policies with flow-based inspection.

Workaround:

Configure a dummy Custom Category and Web Rating Override/Local Rating. Copy and paste the command below into the CLI.

It will still work after it is deleted. Alternatively, delete and re-add one of the existing web rating categories and ratings. If the FortiGate was rebooted, apply the workaround again.

config webfilter ftgd-local-cat
    edit "dummy-cat"
        set id 190
    next
end

config webfilter ftgd-local-rating
    edit "dummy.local"
        set rating 190
    next
end

config webfilter ftgd-local-rating
delete "dummy.local"
end

config webfilter ftgd-local-cat
delete "dummy-cat"
end

The website is accessible:

This issue occurs when the web filter operates in flow-based mode with certificate inspection enabled. Changing the inspection mode to proxy-based on the relevant policy and web filter profile can serve as a workaround.

It is tracked by internal issue ID# 1118132. The issue is resolved in v7.2.12, v7.4.8, and v7.6.3. See Release Notes 7.4.8.