Skip to main content
Sinichi_Kudo
Sinichi_Kudo
Visitor III
May 29, 2026
Solved

APPLYING REPLACEMENT MESSAGE IN POLICY

  • May 29, 2026
  • 4 replies
  • 62 views

How to apply the Replacement Message in Security Profile in your Policy when accessing the blocked websites?

Best answer by Sinichi_Kudo

Hi,

I was able to resolve this concern on my own.

The following steps were performed:

  • Downloaded the Fortinet CA certificate.
  • Installed the certificate in the PC's browser.
  • Confirmed that the replacement message is now displayed when accessing blocked websites.

 

4 replies

funkylicious
SuperUser
funkylicious
SuperUser
May 29, 2026

hi,

maybe this will help - https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/131140/replacement-messages 

when a security profile that is a applied to a firewall policy is triggered by the user it will display the block page corresponding to it, which you can customized as per the link above

"jack of all trades, master of none"
Sinichi_Kudo
Sinichi_KudoAuthor
Visitor III
May 29, 2026

Cannot open

    Anthony_E
    Staff
    Anthony_E
    Staff
    May 29, 2026

    Modifying replacement messages

    The Replacement Messages page has two views. Simple View (the default view) shows the most commonly used replacement messages. Extended View shows the entire list and all replacement message categories.

    To modify a replacement message in the GUI:

    1. Go to System > Replacement Messages.

    2. Select a replacement message and click Edit.

      If the message you want to edit is not visible, click Extended View in the upper right-hand corner of the top menu.

      fa8ef473ac6d3d45cf1fd0e930f0c9f0_select-message.png

    3. Edit the HTML code.

      The message is visible on the left alongside the HTML code on the right. The message view updates in real-time as you edit the content.

      When adding a variable to the code, right-click and select Insert Tag or type %% to view a list of the available variables, or start typing the variable name then press Enter or TAB to auto-complete the variable name.

      82992909e9fb61d4e75a428c95a4b261_edit-message.png

    4. Click Save.

      Click Restore Defaults to return to the original message and code base.

    To modify a replacement message in the CLI:

    For example, to modify the Traffic Quota Limit Exceeded Page message:

    config system replacemsg traffic-quota "per-ip-shaper-block"    set buffer "<html>  <head>    <title>      Traffic Quota Control    </title>  </head>  <body>    <font size=2>      <table width=\"100%\">        <tr>          <td bgcolor=#3300cc align=\"center\" colspan=2>            <font color=#ffffff>              <b>                Traffic blocked because exceeded session quota              </b>            </font>          </td>        </tr>      </table>      <br>      <br>      Traffic blocked because it exceeded the per IP shaper session quota. Please contact the system administrator.      <br>      %%QUOTA_INFO%%      <br>      <br>      <hr>    </font>  </body></html>"    set header http    set format htmlend

    Replacement message images

    Images can be added to replacement messages on:

    • Disclaimer pages

    • Login pages

    • Declined disclaimer pages

    • Login failed pages

    • Login challenge pages

    • Keepalive pages

     

    Here you are  :)

    Best Regards
      Sinichi_Kudo
      Sinichi_KudoAuthor
      Visitor III
      May 29, 2026

      Do you need to apply it to the policy, or just enable the Web Filter? Or do you also need to enable the Web Filter Profile → Replacement Message?

      msanjaypadma
      Staff
      msanjaypadma
      Staff
      May 29, 2026

      Hi ​@Sinichi_Kudo ,

      You will see a blocked page (replacement page) when a user tries to access a website that is restricted in the WebFilter profile, which is applied to the firewall policy. If you are facing any error, you can share the logs?

      If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

      Thanks,
      Mayur Padma

        sjoshi
        Staff
        sjoshi
        Staff
        May 30, 2026

        Hi ​@Sinichi_Kudo ,

         

        To apply a Replacement Message in a Security Profile so that users see a custom block page when accessing blocked websites on a FortiGate:
        1. Configure or Customize the Replacement Message
        In the GUI, go to System → Replacement Messages or System → Replacement Message Groups.
        Create or edit a message group of type Security (UTM).
        Customize the specific type (e.g., FortiGuard Web Filtering – Block Page) to modify the text or HTML.
        Optionally, add graphics under Manage Images, then save your changes.

         

        2. Apply the Web Filter Profile to a Firewall Policy
        Go to Policy & Objects → Firewall Policy.
        Edit or create the policy controlling user outbound web traffic (e.g., LAN → WAN).
        Under Security Profiles, enable Web Filter and choose the profile created above.

         

        3. Verify
        Access a website that should be blocked.
        The browser should now display the customized block page you created.

        Thanks, Salon
          Sinichi_Kudo
          Sinichi_KudoAuthorAnswer
          Visitor III
          June 4, 2026

          Hi,

          I was able to resolve this concern on my own.

          The following steps were performed:

          • Downloaded the Fortinet CA certificate.
          • Installed the certificate in the PC's browser.
          • Confirmed that the replacement message is now displayed when accessing blocked websites.

           

          Terms & ConditionsAccessibility statement