Skip to main content
albaker1
New Member
February 18, 2025
Question

Problem with website blocked, even after exclusion created

  • February 18, 2025
  • 5 replies
  • 2218 views

We have some Ubuntu hosts that need access to a site for updates, and on a "Permit Outbound Web Traffic" rules that includes both 443/tcp and 80/tcp, and there are blocks because of UTM. Specifically, the "Threat Type" is "N/A -Static URL Filter." I put an exclusion in (the FortiManager, running 7.2.8) for the FortiGate (also running 7.2.8) within the Security Profiles > Web Filter for wildcard *.ubuntu.com*, but the block persisted. I then put one in for "connectivity-check.ubuntu.com," which is the first site the hosts try to reach. The blocks continued on. I created a rule to exclude that subnet from the Web Filter, and it works. 

 

I'm at a loss as to why the firewall is behaving this way, and I also can't figure out what "N/A - Static URL Filter" really means in context with the Web Filter. I need to fix this rule, so any help in resolving this would be greatly appreciated.

image.png

image.png

5 replies

Anthony_E
Staff
Staff
February 21, 2025

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
AEK
SuperUser
SuperUser
February 21, 2025

Has the profile been correctly pushed to the FGT? Can you share a screenshot from the FGT?

Do your clients use legacy DNS (UDP) or DNS over TLS/HTTPS?

AEK
albaker1
albaker1Author
New Member
February 21, 2025

It has indeed been pushed:

image.png

 

They use 53/udp for DNS to our internal AD servers.

 

We have other exclusions that are working properly, and I've attempted various iterations for Ubuntu with no success.

 

funkylicious
SuperUser
SuperUser
February 21, 2025

can you show the whole log where the traffic appears blocked ?

"jack of all trades, master of none"
AEK
SuperUser
SuperUser
February 21, 2025

The filter seems correct on the FortiGate. As requested by Funkylicious, try redo the test (i.e.: access ubunto.com via your browser or wget) then share the traffic logs and UTM logs that show denied access to ubuntu site.

You can also debug the traffic for extra information:

diag debug flow filter addr x.x.x.x   (your client's IP)
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 200
diag debug enable

 

AEK
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!