Troubleshooting Tip: How to troubleshoot FortiGuard Web Filter categorization issues

[FTNT_FortiJan]

Description	This article describes how to handle situations where a Web Filter profile with enabled FortiGuard categories shows different FortiGuard category names than the Web Filter Lookup tool at https://www.fortiguard.com.
Scope	FortiOS v7.0+ with Web Filter profile.
Solution	When a Web Filter is configured with FortiGuard categories, FortiGate will send a request to the FortiGuard server for URL ratings. As a response from the FortiGuard server, FortiGate should receive the category name for a requested URL. For HTTPS traffic, it is important to note that if the Server Certificate CN (Common Name) does not match the Client Hello SNI request (Server Name Indication), the URL rating request will be sent based on the Server Certificate CN. Incorrect WebFilter FortiGuard category The following is an example of an URL Filter debug output where the Server Certificate CN (localhost.localdomain) does not match the URL from the Client Hello SNI request (mydomain.example.com). diagnose ips debug enable urlfilter diagnose debug enable [5174@837]ips_eng_log_ssl: ssl log host mydomain.example.com, CN localhost.localdomain, type 12 [5174@837]ips_detect_user_category: no vdom dbs of vdom:0 [5174@837]urlf_query_fgd: id:1652 sess:837 action:0 error:0 src:1 host:localhost.localdomain url:/ rate_ip:0 ssl_exemption_query:0 [5174@837]handle_fgd_answer: sess:837, id:0, action:6, resume:0, error:0, ftgd_category:0, url_category:0, local_category:0, byip:0, log:1, time:0s To disable debugs: diagnose debug disable get webfilter categories    ...    g21 Unrated        0 Unrated In the example above, the URL rating request contains the host 'localhost.localdomain', which is rated by the FortiGuard server with the category name Unrated (ID 0). Note: Web Filter in Flow-based Inspection mode is handled by the IPSengine while Proxy-based Inspection mode is handled by the urlfilter daemon. When checking the URL Rating Cache below, the same category ID may be observed for both the URL and IP address. diagnose webfilter fortiguard cache dump Caution: This command is for diagnostic purposes ONLY. The bigger the cache size is set, the more impact on performance the command has. Do you want to continue? (y/n)y Saving to file [/tmp/urcCache.txt] Cache Contents: -=-=-=-=-=-=-=- Cache Mode: TTL Cache DB Ver: 234.16663 Rating DB Ver DOT SLASH T URL 00000000|00000000 234.16662 -1 -1 E Chttps://109.233.24.62/  00000000|00000000 234.16662 -1 -1 E Chttps://localhost.localdomain/  To resolve this issue, it may be necessary to review server certificate settings on the server side.