Web Filter - Wrong categorization

Forum|Forum|3 years ago
April 17, 2023
3 replies
8762 views

Hello guys!

I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?

FortiWEB

Best answer by jintrah_FTNT

here the access is not blocked based on url rating but based on IP rating.

dstip=157.240.222.60

ratemethod=ip

And the IP is rated under social networking, and hence should be blocked.

best regards,

Jin

jintrah_FTNT

Staff

Hi,

Could you please post the raw log? If web.whatsapp.com is detected by urlfilter, it should have been categorized as webchat, but may be application control detects it as social networking category.

best regards,

Jin

therculanoAuthor

Explorer III

Hello, Kin! I'm not using any app control on my police.

date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=1xx.xx.1xx.xx dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=xxxxxxxxxx group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-jpg_s96x96&ccb=11-4&oh=01_AdRlT46yp1MPBqvBz1NLvCX68Lulf0hMxJDMzr-Od3MmYQ&oe=644A7861 hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=000000000 vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all