FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 193086


This article explains how to exempt or block access to a website using the URL filter feature.






There are three types of URLs that can be defined.


  1. Simple: A simple URL filter entry could be a regular URL.

For example:

  • URL:
  • URL:


  1. Wildcard: A wildcard can be used to include one or more URLs to a simple URL
    For example:


Putting 'space' after '*' on an expression will result in a wildcard match of all URLs.



 *      <----- There is a space between * and yahoomail.


  1. Regular Expressions (regex): Regex is used to include one or more URLs related -or not related- to a pattern using some Perl syntax

For example:- "*" symbol means: match 0 or more times of the character before the symbol, but no match with any character.

For example:"fortinet*.com" will match "" but not ""
"/i" symbols means: makes the pattern case sensitive.

For example:"/FORTINET/i" will not match with "fortinet"
"^" symbols means: at the beginning of the string.

For example:"^fo" will match ''
'.' symbol means: match the same or different character than the one before the symbol, but is followed by the rest of the sentence.

For example:'' will match 'fortinetacom', 'fortinetbcom', 'fortinetzcom'

Configuring a URL filter:



  1. Go to Security Profiles -> Web Filter.
  2. Select a web filter to edit.
  3. Under Static URL Filter, enable URL Filter, and select Create New.
  4. Enter the URL, without the “http”, for example: www.example*.com
  5.  Select a Type: Simple , Regular Expression, or Wildcard. In this example, select Wildcard
  6. Select the Action to take against matching URLs: Exempt, Block, Allow, or Monitor.
  7. Select 'Enable'.
  8. Select 'OK'.

The syntax in the CLI for configuring an entry is:
config webfilter urlfilter
edit <ID>
config entries
edit 1
set url <url>
set referrer-host <url>
set type {simple | regex | wildcard}
set action {block | allow | monitor | exempt}
set status {enable | disable}
To attach the URL filter table to an existing or a new webfilter profile:

config webfilter profile
    edit "webfilter"               <----- Name of the web filter profile.
        # config web
            set urlfilter-table 1  <----- Where x is the URL filter table ID, this number can be found in '3 config webfilter urlfilter' the URL filter created with ID number.

        # config ftgd-wf
            unset options
If the exemption is only needed from Fortiguard filtering then 'set exempt fortiguard' can be used, instead of all.
For all exempt actions: ? is used to show all the available options:
set exempt
av --> Antivirus filtering.
web-content --> Web filter content matching.
activex-java-cookie --> ActiveX, Java, and cookie filtering.
dlp --> DLP scanning.
fortiguard --> FortiGuard web filtering.
range-block --> Exempt range block feature.
pass --> Pass single connection from all.
all --> Exempt from all.
Some sites will be using multiple sub-domains which fall under different FortiGuard category so it will be required to exempt all sub-domains as well in order to access the site.
To check the sub-domains used by a particular site, check browser developer tools.
In Chrome -> Ctrl+Shift+I -> Sources : Here it is possible to check all the sub-domain details.
SSL/SSH deep/full inspection is mandatory for static URL filter working.