Description
This article describes that specifying action as 'Allow' in the URL filter may not allow the URL. This is because any attempt to access a URL that matches a URL pattern with an allow action is permitted.
The traffic is passed to the remaining antivirus proxy operations, including FortiGuard Web Filter, web content filter, web script filters, and antivirus scanning, which may block URL access. Hence, setting the action as exempt allows URL access. However, specifying action as 'Exempt' for a URL in a website bypasses the following security services:
activex-java-cookie - ActiveX, Java, and cookie filtering.
av - Antivirus filtering.
dlp - DLP scanning.
filepattern - File pattern matching.
fortiguard - FortiGuard web filtering.
pass - Pass single connection from all.
range-block - Exempt range block feature.
web-content - Web filter content matching.
av - Antivirus filtering.
dlp - DLP scanning.
filepattern - File pattern matching.
fortiguard - FortiGuard web filtering.
pass - Pass single connection from all.
range-block - Exempt range block feature.
web-content - Web filter content matching.
Scope
URL Filtering.
Solution
To specify what services need to be bypassed for a URL with action set as 'exempt' the configuration needs to be executed through the command line interface using the following syntax based on the following example:
The Fortinet.com URL is added, specifying the action as 'exempt'.
FGT# config webfilter urlfilter
FGT(urlfilter) # edit <ID>
FGT(1) # config entries
FGT(entries) # edit fortinet.com
FGT(fortinet.com) # set exempt ?
activex-java-cookie ActiveX, Java, and cookie filtering.
all Exempt from all.
av Antivirus filtering.
dlp DLP scanning.
filepattern File pattern matching.
fortiguard FortiGuard web filtering.
pass Pass single connection from all.
range-block Exempt range block feature.
web-content Web filter content matching.
FGT(fortinet.com) # set exempt <- Select the services that need to be bypassed.
FGT(urlfilter) # edit <ID>
FGT(1) # config entries
FGT(entries) # edit fortinet.com
FGT(fortinet.com) # set exempt ?
activex-java-cookie ActiveX, Java, and cookie filtering.
all Exempt from all.
av Antivirus filtering.
dlp DLP scanning.
filepattern File pattern matching.
fortiguard FortiGuard web filtering.
pass Pass single connection from all.
range-block Exempt range block feature.
web-content Web filter content matching.
FGT(fortinet.com) # set exempt <- Select the services that need to be bypassed.
Note: Starting from Forti OS v7.6.3, selecting which service will be exempted in URL filter is possible in the GUI.
- AntiVirus - refers to the AntiVirus filtering.
- Legacy filters - refer to Web content, Anti-phishing, Range block, ActiveX, Java and cookies.
- DLP - refers to DLP scanning.
- FortiGate Cloud - FortiGuard web filtering.
Related article:
Technical Tip: Explanation of the Allow, Block, Exempt, and Monitor static URL filter actions
