FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Renante_Era
Staff
Staff
Article Id 294449
Description This article describes how to debug the Video Filter when a YouTube filter is not working correctly.
Scope FortiProxy, FortiGate, v7.0.x and v7.2+.
Solution
  1. Double-check the Technical Tip: Blocking internet traffic but allowing access to specific YouTube Channel through Vid....
  2. Ensure that traffic matched the expected firewall policy.

 

diagnose sys session filter cl
diagnose sys session filter src <IP address>
diagnose sys session list | grep policy_id

 

Screenshot 2024-01-16 110213.png

 

Screenshot 2024-01-16 110529.png

 

  1. Make sure that the API key is configured correctly.

show full | grep -f <API key>

 

Screenshot 2024-01-16 110734.png

 

  1. Double-check the channel ID as well.

show full | grep -f <channel_ID>

 

Screenshot 2024-01-16 111012.png

 

  1. Clear the browser cache and reload the video. 
  2. Confirm block/allow YouTube videos/channels using web filter event logs (FortiGate GUI -> Log & Report -> Security Events -> Web Filter Events). The following images represent an allowed and blocked video web filter log, respectively:

 

allow_video.png

 

block_video.png

 

     7. Additional debug commands can be collected using the following FortiGate CLI commands:

 

Before starting, make sure that the WAD filter is not configured with other parameters: 

 

diagnose wad filter list 

drop unknown sessions: disabled 

 

diagnose debug console timestamp enable  

diagnose wad filter src x.x.x.x               <----- Source IP of the client.

diagnose wad debug enable level verbose

diagnose wad debug enable category video

diagnose wad filter list 

diagnose wad debug show 

diagnose debug enable

 

Stop the debugging after generating traffic to YouTube:

 

diagnose debug disable 

diagnose debug reset