Description
This article describes how to customize replacement messages for individual web filter profiles.
Scope
FortiGate.
Solution
Replacement message groups make it possible to customize replacement messages for individual policies and profiles.
There are two types of replacement message groups:
- Utm: used with UTM settings in firewall policies. Messages in the following categories can be customized: mail, http, web proxy, ftp, nntp, FortiGuard-wf, spam, alertmail, admin, sslvpn, nac-quar, traffic-quota, utm, custom-message, and icap.
- Auth: used with authentication pages in firewall policies. Messages in the following categories can be customized: web proxy and auth.
To create a replacement message group in the GUI:
Make replacement message groups visible in the GUI with the following CLI command:
In FortiOS 7.0 and later:
config system global
set gui-replacement-message-groups enable
end
In FortiOS 6.4 and earlier:
config system settings
set gui-replacement-message-groups enable
end
- Two replacement message groups have been created.
Facebook blocking is one of the groups and Twitter blocking is the other one.
Refer to the pictures below.
Note:
Both belong to the Security group type.
- Along with this, two web filter profiles have been created.
Facebook is the name of the first and Twitter is the second.
- The Facebook website is blocked on Facebook's web filter profile and Twitter website is blocked on Twitter's web filter profile too.
- Along with this, two policies for two hosts have been created.
One policy has Facebook's web filter profile (to block Facebook) while the other one has the Twitter web filter profile (to block Twitter).
- Now as soon as the traffic is initiated, the traffic will be blocked and the replacement message will be displayed.
In PC 1:
In PC 2:
Two separate block pages are visible in the screenshots above. To set this up, follow these steps:
- Edit the replacement message groups (the system will redirect the user to replacement message tab) and search for the URL block page, then customize it accordingly.
- Navigate to the web filter profile and then map the Replacement message group.
Configuration for step 1 is shown below:
Edit the second replacement group.
The second stage is set out below.
config webfilter profile
edit Facebook
set replacemsg-group Facebook\ \ block
next
edit Twitter
set replacemsg-group Twitter\ block
end
As soon as these settings are configured, a different web page block message will be visible.
Note:
There is a possibility that a certificate error may appear instead of the replacement message. Follow the instructions in Technical Tip: Certificate error when accessing blocked page to resolve the issue:
Related article:
Replacement message groups - FortiGate administration guide.
