Skip to main content
pblazey
New Member
June 12, 2024
Question

FC EMS blocking a URL that is not a valid FQDN

  • June 12, 2024
  • 1 reply
  • 845 views

Hi,

Got a bit of a weird issue with our EMS.

 

Users are somehow generating a link that looks like data[:]application/9IZCADpxCi (random text follows) (without square brackets). I can see in our FortiAnalyzer there's a log for them looking up the "rating" of this URL, and it comes back as unrated (obviously, it's not a real, reachable or resolvable FQDN). I've tried exempting both data[:]application (without square brackets) and http://data/* from the web filter, which syncs from the FortiGate to EMS (as this is the URL that FC EMS actually logs as being blocked) but FC EMS is still blocking the URL locally on the user's device.

 

I'm no expert with this stuff, but this seems like a URL used to access a local server/filestore or something like that? I'm really not sure, it's obviously not resolvable over the internet, I've run Wireshark capture and can see that my network adapter doesn't send a DNS query when I enter this URL into my browser.

 

Any advice would be greatly appreciated

1 reply

ozkanaltas
Valued Contributor III
June 13, 2024

Hello @pblazey 

 

Can you try that "data:*" and "data[:]*"?

 

Also, you can allow unrated websites on FortiClient. 

 

image.png