Issue blocking Youtube

4 replies
39927 views

Fortigate 80C Firmware 5.0

I am having an issue trying to block youtube.com.

[ul]

I have the web-filter subscription.

I have edited the Web filter profile to block all "Bandwidth consuming" sites (Streaming ect)

Enabled website filter, *Youtube.com / Wildcard / Block / Enable. [/ul][ul]

I have added Web filter to my policy for my network. (Internal 2 - WAN 1)

I rebooted the Fortigate to ensure all sessions were stopped, so this could take effect. [/ul]

People on the network are still accessing Youtube.

Still no luck, Any assistance would be appreciated.

Dave_HallAnswer

New Member

"Deep packet" inspection needs to be enable on the firewall policy covering "web traffic" - otherwise "blocking" just by web/URL filter (via security certificate inspection) may/will not work (because youtube uses Google's *.wildcard security certificate).

If Application Control does not work and you can not use "Deep packet" inspection then you could try blocking direct access to the main fqdn addresses via firewall polices - IMO it's "ugly" but does work to a certain extent. YMMV.

Another option would be to use DNS web filtering.

Toshi_Esumi

SuperUser

URL based blocking probably wouldn't work well. Try using Application Control instead like below. Also we have Application Control Forum about it where you can search more.

http://cookbook.fortinet....-youtube-applications/

Dave_HallAnswer

New Member

"Deep packet" inspection needs to be enable on the firewall policy covering "web traffic" - otherwise "blocking" just by web/URL filter (via security certificate inspection) may/will not work (because youtube uses Google's *.wildcard security certificate).

If Application Control does not work and you can not use "Deep packet" inspection then you could try blocking direct access to the main fqdn addresses via firewall polices - IMO it's "ugly" but does work to a certain extent. YMMV.

Another option would be to use DNS web filtering.

GoatrmanAuthor

New Member

Toshi and Dave, Thanks for the responses, I will try these suggestions and report back with my results.

Sign up

Login with SSO

Login to the community

Login with SSO