Web Filter does not work properly in FortiClient 7.2.X

Question

After upgrading from FortiClient 7.0.10 to 7.2.3, I've noticed that the exclusion list in the Web Filter no longer works. No changes were made to the web filter policies, web browser plug-in is enabled in the policy and installed on the client, what gives? My clients are all configured to use the web fliter plugin only when the endpoints are off-fabric,

sync mode ad check user initiated traffic only are both enabled in their profiles. I've tried every combination of the three and get the same result.

For example, If I try to block Facebook, Twitter, or TikTok using a deny entry for each in the Web Filter Exclusion list, the sites do not get blocked on the client. I've tried all three exclusion types (Simple, Regular Expression, and Wildcard) and none of them block the sites any longer.

I've tried in both Edge and Chrome with the same results.

Downgrading back to 7.0.10 resolves the issue.

Anyone else experiencing this?

FortiNet_Newb · Accepted Answer

Just updated to FortiClient to 7.2.5 and was pleasantly surprised to find that all of my web filter issues are now resolved. With the option "Wildcard Match Root Domain" enabled and in the Exclusion list setting Action: "Block", Type: "Simple", and URL as "whateverdomain.com" everything works perfectly now. It's odd because the release notes disclose the following as a new known issue:

1054211

Web Filter exclusion list Action > Block does not work as expected.

However, in my case it now works as expected for some reason, when it didn't in prior versions. So glad that is now working.

FortiNet_Newb · Answer

Not sure how I missed it earlier (unless it wasn't listed yet), but it appears to be the below bug that affects versions 7.2.1 - 7.2.3 in combination with the FortiClient Web Filter handling the Wildcard type expressions differently than the FortiGate and FortiClient versions before 7.2.1 do.

875298

Exclusion list does not work properly with regular expressions.

I had erroneously assumed that the FortiClient 7.2.3 web filter would process the filtering types the same way the FortiGate Web Filter does which is outlined here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-URL-Filter-expressions-for-the-FortiGate/ta-p/192746

Unfortunately, it seems as though the Wildcard filtering type does not behave the same way in the FortiClient 7.2.1+ web filter as they do in earlier versions of FortiClient (or as they do in a FortiGate web filter profile). I was finally able to block websites using FortiClient 7.2.3 by using the Wildcard type filter and using it in the format of *Website.com, using *.Website.com would NOT block Website.com as was the previous behavior.

Sign up

Login with SSO

Login to the community

Login with SSO