Skip to main content
CHR57
CHR57
Explorer II
October 8, 2019
Solved

Web Filter / Static URL filter

  • October 8, 2019
  • 2 replies
  • 5580 views

I have no Internet access out from a vlan. I would just allow certain URLs to be allowed.

I have created a policy that I have added a Web Filter to.

In the Webfiler I have added Static URLs. For example:

URL *mcdonalds.com

Type Wildcard

Action Allow

Status Enable

 

I end the Statatic URL with:

URL *

Type Wildcard

Action Block

Status Enable

 

Is this the right way to do it?

If the request matches this policy source, destination etc it looks like the last * Block stops the request from continuing go throw other policies.

 

 Fortios 5.6.9

Best answer by sw2090

I think this will not work as two of your url filter rules will match this. What mathes *mcdonalds.com also matches the block all rule you have. So this means first rule will grant access to *mcdonalds.com but the 2nd coming aftr it will block it - in summary it will then be blocked since the block all rule is tlhe last rule.

This should do if you set the action for *mcdonalds.com to exempt instead of allow because allow does not stop the filter from proving against further rules and cathegories but exempt does just that.

2 replies

Dave_Hall
Dave_Hall
New Member
October 8, 2019

It may work, assuming you are using deep (full SSL) inspection.  If you are not using full SSL, you likely need to apply security certificate inspection.  e.g. most all sites these days use HTTPS (encrypted connections).

 

If you peek at the security certificate for the site you are blocking/unblocking, you can see the website name, which should match the URL you are trying to block/unblock. 

 

Alternate FQDNs may also be listed in the security certificate.  You may need to apply/add other URL filters to completely block/unblock a site.  Also keep in mind that some sites might be pulling page elements from other domains.

 

sw2090
SuperUser
sw2090Answer
SuperUser
October 9, 2019

I think this will not work as two of your url filter rules will match this. What mathes *mcdonalds.com also matches the block all rule you have. So this means first rule will grant access to *mcdonalds.com but the 2nd coming aftr it will block it - in summary it will then be blocked since the block all rule is tlhe last rule.

This should do if you set the action for *mcdonalds.com to exempt instead of allow because allow does not stop the filter from proving against further rules and cathegories but exempt does just that.

Terms & ConditionsAccessibility statement