Technical Tip: Enable Web Filter only when the user is off-fabric (off-net) when connected to public internet

[babakmh]

Description	This article explains the correct way to enable a web filter feature that is only active when the endpoint goes off fabric.
Scope	FortiClient EMS.
Solution	This is a common practice to keep FortiClient Web Filter module disabled when the user is on-net (on fabric) since firewall can take care of web filtering when the endpoint is in the office. Set the option 'Enable WebFiltering on FortiClient' under Web Filter profile to 'Only When Endpoint is Off-Fabric' can cause the extension to be installed on browser due to an existing known issue. In order to prevent this to happen, do the following steps: Configure off-fabric Web Filter profile and set 'Enable WebFiltering on FortiClient' to 'Always On' and enable the profile on top:   Configure an on-fabric Web Filter profile and make it disabled:   Under EMS policy, toggle on Profile (Off-Fabric) on top, then use WF profile with Always On for off-fabric (right column).