Technical Tip: Blocking internet traffic but allowing access to specific YouTube Channel through Video Filter

[Renante_Era]

Description	This article describes how to block internet traffic but allow access to a specific YouTube Channel through the use of Video Filter.
Scope	FortiOS 7.2+.
Solution	Internet traffic can be blocked by removing the LAN>WAN firewall policy. However, in some cases, administrators need to allow internet access to specific sites through a Web Filter profile that blocks all categories in FortiGuard Category Based Filter, then allow or exempt some sites through the URL Filter. For example, the administrator might block the Bandwidth Consuming category as well as Streaming Media and Download, but still want to allow access to a specific YouTube Channel that may be informative and useful for network users. To block all categories in a FortiGuard Category Based Filter but allow a specific YouTube channel, the steps are as follows: Open the FortiGate GUI and select Security Profiles -> Video Filter. If it is not visible, open the CLI console and enter the following commands: config system settings set gui-proxy-inspection enable end After, enable or toggle System -> Feature Visibility -> Video Filter. Open Security Profiles -> Video Filter, then select Create New, enable the FortiGuard Category Based Filter, select all categories by pressing Ctrl+A, and select Block. Scroll down and enter the YouTube API Key, then select Create New and add the Channel ID. To identify a YouTube channel's ID, follow the steps in this article: Technical Tip: Get the channel ID for video filtering If no YouTube API Key is available, create one using the following steps: Create a Google account, such as a Gmail account. Open a browser window navigate to https://console.cloud.google.com/api/dashboard and login with the Google account. Create a New Project. Enable YouTube Data APIv3.   Create a New Credential and copy the API Key. After obtaining a Video Filter Profile, clone the default Application Control profile and block QUIC. If blocking all Application Control categories, make sure to allow YouTube in the Application and Filter Overrides. Furthermore, if applying Web Filter profiles in the firewall policy, exempt YouTube using RegEx youtube\.com and youtu\.be via Static URL filter.   Create or modify the corresponding Policy & Objects -> Firewall Policy and ensure that it is using a Proxy-based inspection mode and deep inspection. Select the Video Filter Profile and Application Control profile. Open a browser and test YouTube video access. It should now be possible to play a YouTube video from the allowed channel while videos from other YouTube channels are blocked.