Technical Tip: Difference between action 'Allow' and 'Exempt' in static URL filter

metz_FTNT · ‎11-29-2022

Description

This article describes the difference between the 'Allow' and 'Exempt' actions in static URL filter configuration.

Scope

In the Web UI, the static URL filter and FortiGuard category filters are both located within the Web filter profile configuration:

However, in CLI and in FortiOS in general, the static URL filter list is not part of the Web filter profile, instead it is configured separately as follows:

# config webfilter urlfilter
edit 3
set name "test"
config entries
edit 1
set url "example.com"
set exempt web-content
next
end
next
end

Then applied to the WebFilter profile as follows:

# config webfilter profile
edit "test"
config web
set urlfilter-table 3 -> URL filter list '3' applied.
end
config ftgd-wf
unset options
end
next
end

When FortiGate performs a web filter check, it will first check the static URL filter list (if applied to the profile) and based on the action, will then perform the FortiGuard category check.

'Action' descriptions in Static URL see bellow:

- 'Block' -> destination is blocked and session dropped, no further category check is needed.

- 'Allow' -> destination is allowed from the static URL list, FortiGate proceeds with checking the category to decide further action.

- 'Exempt' -> destination is exempted from further inspection and traffic is allowed.