Skip to main content
khemlina
khemlina
Explorer
August 10, 2023
Solved

whitelist specific user IP address from block all users web filtering in Fortigate 100F

  • August 10, 2023
  • 8 replies
  • 6746 views

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

Best answer by Rajneesh

You can create a new policy and in the source allow the  few IP address of this Vlan4 to access Social Media and keep that policy in top or above the Block_Social_Media, 
As mentioned by @pjawalekar the policies will be checked from top to bottom and with first match it will stop the policy lookup.

 

 

8 replies

VinayHM
Staff
VinayHM
August 10, 2023

Hi @khemlina 

 

You can create one more policy on top of this to allow those users and not block social media ( create another custom web filter ) In the UTM profile.

 

Regards,

    khemlina
    khemlinaAuthor
    Explorer
    August 10, 2023

    Hi @VinayHM 
    I'm not sure understand well so
    1-create another web filter (ex: No_Block_Social_Media)

    2-create source address (IP address that we allow to access social media)
    3-create policy

     

    pls help to add more details for this.
    thanks

    VinayHM
    Staff
    VinayHM
    August 10, 2023

    Hi @khemlina 

    Yes, Create a new web filter and make sure social media is allowed.

    create another policy (on top where vlan 4 users are blocked by social media), In this policy call the newly created web filter.

    And finally, Call the user group or address object in the source address.

     

    Regards,

      pjawalekar
      Staff
      pjawalekar
      Staff
      August 10, 2023

      Hi @khemlina,

       

      As you have configured the firewall policy with web filter profile to block the Social Media for vlan subnet, you can create one more policy for the specific ip's which you want to allow the social media access. You need to keep this policy above the existent one as the policies will be checked from top to bottom and with first match it will stop the policy lookup.

      Below is the KB article which will be useful to understand how you can create the welbfilter profile to allow or block the specific url's

      https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-a-static-URL-filter-feature-to-allow-block/ta-p/193086   

       

      Regard's,
      Pratik

       

        Staff
        RajneeshAnswer
        Staff
        August 10, 2023

        You can create a new policy and in the source allow the  few IP address of this Vlan4 to access Social Media and keep that policy in top or above the Block_Social_Media, 
        As mentioned by @pjawalekar the policies will be checked from top to bottom and with first match it will stop the policy lookup.

         

         

          khemlina
          khemlinaAuthor
          Explorer
          August 10, 2023

          Hello all
          Thanks for your guideline. Now It's working.

            Jesuis160
            Jesuis160
            New Member
            June 5, 2025

            Same here.

            Terms & ConditionsAccessibility statement
            Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!