Skip to main content
mkratel
mkratel
New Member
May 7, 2021
Question

Unable to get to site that I have allowed

  • May 7, 2021
  • 1 reply
  • 5140 views

DISCLAIMER: I'm new to firewall administration and FortiGate products as a whole.

 

Our users are unable to access any state government websites, ending with the state domain name, hawaii.gov. We don't have any rules explicitly blocking these sites or this domain, and I have added rules in the FortiGate to explicitly allow them. Here are the steps I've taken so far:

[ul]
  • Under Policy & Objects, I've created an FQDN Wildcard for the *.hawaii.gov domain
  • Under Security Profiles, Web Filter, I've created a Static URL Filter to allow *.hawaii.gov as a wildcard, as well as added the full web address as a Simple.
  • Under Security Profiles, DNS Filter, I've created a Domain Filter for *.hawaii.gov as a wildcard, as well as added the full web address as a Simple.[/ul]

    None of this would allow us to get to the website, until I specifically added the IP address and DNS name of the website in the computer's hosts file.

     

    What am I missing?

      • 1 reply

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      May 9, 2021

      Sounds like DNS filter is blocking it, not web filtering. To start, create a simple policy with the wildcard FQDN (assuming 6.2.2 or above) as destination then service: DNS, HTTP/HTTPS, and allow for the action without any protection profile. Place it at the top of the policies. Make sure this works.

      Then you can start adding those DNS filter then Web filter and others, one by one. With that way, you can know what is causing the block, and go back one step then tweak the profile.

       

      Or, more direct method is to run "flow debug" by searching how to do it on the internet, or in the forum, to see the direct cause of blocking.

      emnoc
      emnoc
      New Member
      May 9, 2021

      agreed and i would double check the fqdn list

       

       

      e,g. diag firewall fqdn list | grep haw

       

      Ken Felix

      Terms & ConditionsAccessibility statement