Ask - Use Fortigate - Web Filter - unlicense

Keeping an unsupported network/security device in production network should not be allowed (pseudo security).

Basically without a valid subscription the communication with FortiGuard services is not possible and the UTM features are practically not functional. The web filter may be blocked because of a rating error (it may be bypassed by 'Allow websites when a rating error occurs'), more details are shown here.

Hi @papapuff ,

1. can we use old fortigate without license for basic firewall, as above?

A:  Yes, you can still use the URL Filter list even if you do not have a web filter license.   For the URL Filter list usage, please check the following KB:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-a-static-URL-filter-feature-to-allow-block/ta-p/193086

But for AV, I am not sure whether it will be working or not.   You may test it with Eicar:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-set-correctly-Antivirus-for-EICAR-test/ta-p/272891

2. why my problem occur, client can't connect internet?

A:  Please share the FGT configurations (tell us which firewall policy, and Web Filter profile are in use).

Apparently, something is wrong with your URL Filter entries.  If the URL in the CA certificate is not the same as the real URL you need to access, you have to use Deep Inspection instead of Certificate Inspection.

Not sure what your FortiGate version is, but the following doc should still have the info for Deep Inspection:

https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/122078/deep-inspection

Hi

Yes, you can use an old FortiGate device without a license for basic firewall functionalities. Here are some steps to help you achieve your requirements:

1. **Restricting User Access to Certain Ports**:
- Create a firewall policy to restrict user access to specific ports by defining the source, destination, and services allowed.
- Ensure the policy is correctly configured to only allow internet access to exact addresses.

2. **Using Antivirus with Latest Definitions**:
- Activate the antivirus feature on the FortiGate device.
- Ensure that the antivirus profile is configured to scan traffic for viruses with the latest definitions.

3. **Setting up VPN IPSec**:
- Configure VPN IPSec tunnels between your FortiGate devices or other clients.
- Ensure that the VPN settings, including encryption algorithms, authentication methods, and pre-shared keys, are correctly configured on both ends.

Regarding the issue with the web filter policy causing all clients to lose internet access, it seems like the web filter policy might be blocking all traffic unintentionally. Double-check the web filter rules and ensure they are configured correctly to allow necessary internet access while still providing the desired restrictions.

yes in fact the webfilter does block everything if it is enabled on a policy without valid license.

I don't think antivirus will get any definition updates without valid fortiguard license.

Since url filter list is a part of the webfilter I don't think you can use it without valid license.

What you can do:

you can restrict the user by port (i.e. service in FortiOS) definition

you can restrict the destination by using FQDN addressobjects (those do support wildcards)

you can to IPSec VPN

But you might have limitations on users usw.