Temporary allow Chrome updates

Forum|Forum|3 months ago
May 19, 2026
2 replies
100 views

Hello there!

I think I’m missing out something simple.

I’m on FortiOS 7.4.12. This FW is filtering all traffic from workstation to the Internet via a policy with web filter enabled that allows (among others) Google map navigation.

Now I need to temporary allow Chrome updates in addition to the traffic usually allowed by my webfilter.

I know there is a specific application control for that but I don’t understand how to use it. I can’t put this profile in my usual rule as I do NOT want the webfilter to be modified. I can’t put a policy with the application control before my webfilter rule as this would block all non-update traffic. I can’t put a policy with application control after my webfilter policy as this would never match.

How to achive this?

Thank you in advance!

FortiGate

sjoshi

Staff

Hi @dan-it

Application Exceptions (e.g., Chrome Updates)
Application Control Override:
Go to Security Profiles → Application Control → Application Overrides, create a new override for the specific app (like Chrome Updates) and allow or exempt it.
Web Filter Static URL Exception:
Edit the Web Filter profile → Static URL Filter → Create New, then add Chrome update domains (e.g. clients2.google.com, dl.google.com), and set them to Exempt.

Thanks, Salon

dan-itAuthor

New Member

Hey @sjoshi thank you for your message but I’m not getting it.

Into the Security profile I must pick a choice for the categories, what should I choose?

Also having to specify the static urls in my existing webfilter requires me to list all google domains which is the point of using application control in the first place.

Moreover I do not understand how those two will work together. If I put them in the same policy then:

the application control blocks everything except google chrome (if I block the other categories) or
as other categories are allowed they can use every google service because in my web filter I excluded something like *.google.com

I’m still not getting it.

My problem is that I have a policy with webfilter enabled and some URL excluded (mostly google maps but also others) and I’d like to temporary allow chrome updates without having to list every single chrome-update-related domains.

Thank you for your time.

Sign up

Login with SSO

Login to the community

Login with SSO