Skip to main content
daveteoh
daveteoh
New Member
August 20, 2014
Question

fortiguard categories blocking, but allow one youtube.com?

  • August 20, 2014
  • 4 replies
  • 38525 views
Hi All, I' d like to block all streaming and downloads website under FortiGuard categories but allow youtube.com access which is fall under this category. I' ve been finding options to configure this but cant find it. any sifus can help me on this? Dave

    4 replies

    hklb
    hklb
    Visitor III
    August 20, 2014
    Hello, try to do a web rating overide : add www.youtube.com in custom category " custom1" , and in web filter allow the custom1 category
    Warren_Olson_FTNT
    Staff
    Warren_Olson_FTNT
    Staff
    August 21, 2014
    You should also be able to add a urlfilter list and add youtube.com with status of allow on it.
    FortiAdam
    FortiAdam
    New Member
    August 22, 2014

    In theory you would think that would work but I can tell you that in version 5 and above that isn' t the case. If you allow in the URL filter but the fortiguard category is set to block the website will still get blocked. Feel free to join the discussion on this here https://forum.fortinet.com/FindPost/112190 The OP would really be better off creating a category override for youtube.com and then allowing that category in the webfilter profile.

    Warren_Olson_FTNT
    Staff
    Warren_Olson_FTNT
    Staff
    August 22, 2014
    Yea I used to use urlfilters in 4.x like this I guess I hadnt tried in 5 and now that I have it does seem to block regardless...thanks for heads up.
    Dave_Hall
    Dave_Hall
    New Member
    August 22, 2014
    Keep in mind that other than block and exempt the Fortigate will still subject the request to other UTM/web filter options. This is pretty much why some things do not seem to " work as expected" . (see pic) There is a couple problems with trying to block or allow youtube. One is Google is using a wild-card " *.google.com" certificate for most of their web/network services, including Youtube.com. So without enabling deep " packet" inspection, the Fortigate really can not tell by checking the domain name on the cert which google site your " users" are visiting. (Edit: of course, I am referring to https connections to youtube in the above sentence.) Second problem is google/youtube uses 3rd party content servers for streaming media content from local " mirrors" . So simply blocking or allowing " youtube.com" at the URL or FortiGuard web filter level will not apply to those 3rd party content servers. That said, we have had better luck using a combination " youtube FQDN/IP static group" firewall policy with an application " youtube" sensor. Haven' t deployed 5.x on the fgt devices we manage, but I hear it is a lot better at detecting/managing youtube than on 4.0 MR3...especially with detecting SPDY traffic.
    Terms & ConditionsAccessibility statement