Fortigate Web Filter Overide

Question

I am trying to test the Web Filter Profile Override blocked categories feature. When I set the option to “IP” it works fine. When I set to either User,User Group or Ask it ddoes not work.

Scenario 1:

I set the Option to User Group, I select the User Group, the Web Filter that will bypass the category block, then I configure the Firewall policy source with the suer group and “all”.

When I surf to a blocked category it allows it rather than getting the block page. When I remove the user group from the Firewall policy then I get the block page but It says “Only User based Overrides are allowed…..”

Scenario 2:

When I set the Web Filter Override to “Ask”, then configure the firewall policy with the user group, I do not get the block page

If I remove the User Group from the Firewall Policy then I get the block page but I am not presented with User Group Options.

I have followed the KB but cant get this to work.

https://docs.fortinet.com/document/fortigate/7.6.7/administration-guide/408599/web-profile-override#using-the-ask-feature

osoleimani · Answer

Hi grod7777,One additional point from the Ask behavior is worth checking: the override needs FortiGate to be able to identify the user making the request.Since your IP-based override works but the User/User Group and Ask behavior changes depending on whether the group is present in the firewall policy, I would verify that the affected request is associated with an authenticated user when the Web Filter block page is generated.In particular, check whether FortiGate can identify the user through the authentication method being used, rather than only confirming that the user group exists in the firewall policy.This would help distinguish between the Web Profile Override configuration itself and the user-identification state of the session.Hope this helps narrow down why the IP-based override works while the User/User Group and Ask behavior does not.

Sign up

Login with SSO

Login to the community

Login with SSO