Technical Tip: Replacement Message not visible for all websites when accessing blocked websites by web filter and Application Control

[fdsantos]

Description	This article describes why sometimes the Replacement Message is accessible and sometimes it is not when accessing blocked websites.
Scope	FortiGate, Google Chrome, Edge, Firefox.
Solution	When accessing websites blocked by a web filter or application Control, three scenarios can occur. Scenario 1: In this scenario, it shows a message when accessing the blocked websites. After selecting 'Proceed', it is possible to access the replacement message. Scenario 2: In this scenario, there is no option to proceed to the website. It shows the error message 'An application is stopping Chrome from safely connecting to this site' and ''Fortinet' was not installed properly on the computer or the network:'. The reason for this behavior is the HSTS (HTTP Strict Transport Security) which is implemented by the website. HSTS is used by websites as a protection from MiTM attacks and always secures connection by redirecting the website to HTTPS. Since FortiGate Replacement Messages involve MiTM, the browser will not allow to proceed to the Replacement Message due to HSTS applied by the website. In this case, the solution is to install the CA certificate used in the SSL inspection profile to proceed with the Replacement Message without any issues. Scenario 3: If the firewall policy references an Application Control that blocks applications (including web applications) and also references the SSL Inspection 'no-inspection', the website will be blocked, and the browser will not display the replacement message. Instead, the browser will display the error 'This site can’t be reached' with the error code ERR_TIME_OUT. This is an example of an App Control policy that blocks Social media application, such as Facebook: If the SSL Inspection profile is set with 'no-inspection' the users will not see the replacement error: To fix this, ensure that the firewall policy is using SSL Inspection 'Certificate Inspection' or 'Deep-Inspection'. If using 'Deep-inspection', be aware that additional configuration needs to be implemented to prevent users from seeing a certificate warning when going to allowed applications. See related article for more information: Related articles: Troubleshooting Tip: Resolving NET: ERR_CERT_AUTHORITY_INVALID Error in Google Chrome Behind a Forti... How to enable deep inspection and import ... - Fortinet Community