FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Lovepreet_Dhillon
Article Id 266783
Description This article describes the changes in default behavior for video filter actions between FortiOS 7.0.6-7.2.4 & 7.2.5 onwards.
Scope FortiOS 7.0.6-7.2.4 & 7.2.5 onwards.
Solution

On version 7.0.6-7.2.4.

A YouTube video will be blocked if action is set to block in either FortiGuard category or YouTube-channel filter.

To prioritize an action under the Youtube Channel filter over the FortiGuard category's action, the following features are recommended under the YouTube-channel-filter config.

  1. YouTube API key.
  2. Set override-category enable.

Use case scenario :

YouTube-channel-filter for specific channels with Action allow.

FortiGuard category with action block for the rest of the videos of that category.

 

config videofilter youtube-key

    edit 1

        set key <enter the key here>

    next

end

 

config videofilter youtube-channel-filter

    edit 1

        set name "Bypass channel"   <- Video filter profile name.

        set default-action block 

            config entries

                edit 1

                    set action allow

                    set channel-id "channel ID"

                next

            end

        set override-category enable

        set log enable   

    next

end

 

From 7.2.5 & 7.4.0 onwards :

 

From 7.2.5/7.4.0 onwards video filtering is done in a multi-tiered approach and if a YouTube channel filter is configured it will be prioritized over the category filter.

 

  1. If a video matches a YouTube channel ID configured under the YouTube channel filter, it will be blocked or allowed depending upon the action configured under the YouTube channel filter.
  2. If a video does not match the YouTube channel ID configured under the YouTube channel filter, FortiGate will check the category filter to find a match and block/allow/monitor the traffic as per the action set under that category.
  3. If no category matches or the FortiGuard category option is disabled, the default action in the video filter profile will be applicable.

 

Additional notes :

The option default-action is moved from config video filter youtube-channel-filter to config videofilter profile.
The option override-category is being removed from the config on 7.2.5 onwards.

 

config videofilter youtube-channel-filter

    edit 1

        set name "test"

        set default-action  <- Removed already and moved to config videofilter profile.

        set override-category enable/disable <- Removed.

 

Related article:
Technical Tip: How to restrict YouTube channels using video filtering.