Technical Tip: Web Filter authentication for Youtube access

[jdelafuente_FTNT]

Description

This article describes how to require an authentication user portal using Web Filter to access Youtube.

Scope

FortiGate, Web Filter, Authentication, Youtube.

Solution

1. Local Category:
   

Create a new Web Custom Category  named 'youtube' and override all URLs:

config webfilter ftgd-local-cat

    edit "Youtube"

    set id 148 

    next 

end

config webfilter ftgd-local-rating

   edit "Youtube"

    set rating 148
next
edit "rr1---sn-njaeyn7z.googlevideo.com"
    set rating 148
next
edit "googlevideo.com"
    set rating 148
next
edit "i.ytimg.com"
    set rating 148
next
edit "video.flim6-3.fna.fbcdn.net"
set rating 148
next
edit "youtube-ui.l.google.com"
    set rating 148
next
edit "www.youtube.com"
    set rating 148
next
edit "play.google.com"
    set rating 148
next
edit "www.youtube.com/api/stats"
    set rating 148
next
edit "rr1---sn-8pxuuxa2xg0-aphl.googlevideo.com"
    set rating 148
next
edit "www.youtube.com/youtubei/v1"
    set rating 148
next
edit "www.youtube.com/embed"
    set rating 148
next
edit "rr2---sn-5hne6nz6.googlevideo.com"
    set rating 148
next
edit "safebrowsing.google.com"
    set rating 148
next
edit "sb-ssl.google.com"
    set rating 148
next
edit "www.youtube.com/sw.js"
    set rating 148
next
edit "sb.l.google.com"
    set rating 148
next
edit "google.video.com"
    set rating 148
next
edit "ad.doubleclick.net"
    set rating 148
next
edit "youtube-nocookie.com"
    set rating 148
next
edit "www.youtube.com:8010"
    set rating 148
next
edit "yt3.ggpht.com"
    set rating 148
next

edit "www.youtube.com/?hl=es&gl=MX" <----- Spanish, Mexico.
    set rating 148
next

edit "www.youtube.com/?hl=en&gl=GB" <----- English, Great Britain.
    set rating 148
next

edit "www.youtube.com/?hl=po&gl=BR" -> Portuguese, Brazil
    set rating 148
next

edit "www.youtube.com/?hl=de&gl=DE" -> Deutsche, Deutschland
    set rating 148
next

end

2. Users and groups:
   

Configure new user and user group, refer to point 1 of the following article:

Technical Tip: Creating a Web Filter profile with user authentication

3. Web Filter Profile:
   

Create a new Web Filter profile and configure user authentication for the local category 'Youtube'.

• Go to Security Profiles -> Web Filter -> Create New -> Name, FortiGuard Category Based Filter -> Local Categories select 'Youtube'-> then  Authenticate. 

 

• Select User Groups, then select OK.

 

4. Firewall Policy:
   

Create a firewall policy as follows:

• Name: YoutubeAuthentication.
• Incoming Interface: LAN.
• Outgoing Interface: WAN.
• Source: all.
• Destination: all.
• Service: all.
• NAT: Enabled.
• Web Filter: YouTubeAuth.
• SSL Inspection: Certificate Inspection.

Related documents:

Technical Tip: Web Filter Authentication for local categories

Technical Tip: Creating a Web Filter profile with user authentication

Video: Flow Mode Webfilter Support (Warning/Authenticate/Override).

Flow-based web filtering.