|
Some users try to block YouTube while still allowing access to Play Store services.
To achieve this configuration, users may configure a combination of Application control profile + Webfilter profile + Certificate inspection profile on the firewall policy.
config firewall policy
edit 4
set name "Blockyoutube"
set srcintf "internal"
set dstintf "wan1"
set action accept
set srcaddr "192.168.10.0"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "SSL_certificate-inspection"
set av-profile "AV_USER"
set webfilter-profile "WF_Google"
set application-list "AC_Google
set logtraffic all
set nat enable
end
If users block all of the YouTube categories in the Application control profile, users will not be able to access any YouTube services. However, when trying to download any application from the Play Store, some URLs are recognized as part of the YouTube category and therefore will be blocked.
In this scenario, if users try to exempt the URLs in the Webfilter profile, the configuration will not work as the evaluation order in FortiGate is the following:
- Application control.
- Webfilter profile.
As the application control already blocks the URLs, the Webfilter exemptions will be bypassed.
Solution:
To achieve this configuration, the following changes should be applied:
- In the Application control profile, allow the YouTube category.
- In the Webfilter profile, block the YouTube URL using a wildcard format and exempt the URLs from Playstore services.
|
