Troubleshooting Tip: Web rating override is not working

[rishab444]

Description	The article describes how to fix the problem when Web Rating override is used to allow a website, but there is no impact, or sometimes the impact is very inconsistent.
Scope	FortiGate.
Solution	The Web rating override works consistently with an override to the 'Custom' Category. In the CLI, run the following commands: execute log filter category 3           <----- Web filter category ID. execute log filter field srcip 192.48.1.2 execute log display date=2024-12-22 time=13:54:56 eventtime=1734893696235188233 tz="-0500" logid="0317013312" type="utm" subtype="webfilter" eventtype="ftgd_allow" level="notice" vd="root" policyid=1 poluuid="b5737652-bee5-51ef-068b-5b2ac0dd2b1a" policytype="policy" sessionid=879727 srcip=192.48.1.2 srcport=49486 srccountry="United States" srcintf="port3" srcintfrole="undefined" srcuuid="5465ab26-b41a-51ef-cce7-1754ece7dc2c" dstip=160.153.61.67 dstport=443 dstcountry="United States" dstintf="port1" dstintfrole="undefined" dstuuid="5465ab26-b41a-51ef-cce7-1754ece7dc2c" proto=6 service="HTTPS" hostname="rabudiagnostic.com" profile="Clone of default" action="passthrough" reqtype="direct" url="https://rabudiagnostic.com/" sentbyte=2048 rcvdbyte=0 direction="outgoing" msg="URL belongs to an allowed category in policy" ratemethod="domain" cat=140 catdesc="custom1" The Web rating override is inconsistent and does not work as well with standard categories, for instance, under General Interest -> Personal -> Health and Wellness: Log: date=2024-12-22 time=13:49:03 eventtime=1734893343179517841 tz="-0500" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" policyid=1 poluuid="b5737652-bee5-51ef-068b-5b2ac0dd2b1a" policytype="policy" sessionid=876687 srcip=192.48.1.2 srcport=49451 srccountry="United States" srcintf="port3" srcintfrole="undefined" srcuuid="5465ab26-b41a-51ef-cce7-1754ece7dc2c" dstip=160.153.61.67 dstport=443 dstcountry="United States" dstintf="port1" dstintfrole="undefined" dstuuid="5465ab26-b41a-51ef-cce7-1754ece7dc2c" proto=6 service="HTTPS" hostname="rabudiagnostic.com" profile="Clone of default" action="blocked" reqtype="direct" url="https://rabudiagnostic.com/" sentbyte=2160 rcvdbyte=0 direction="outgoing" msg="URL belongs to a denied category in policy" ratemethod="domain" cat=61 catdesc="Phishing" crscore=30 craction=4194304 crlevel="high" The inconsistency is observed when the Standard category action is set to 'Allow'. To fix this, change the action on a standard category to 'Monitor'. Log: date=2024-12-22 time=13:57:24 eventtime=1734893844393966980 tz="-0500" logid="0317013312" type="utm" subtype="webfilter" eventtype="ftgd_allow" level="notice" vd="root" policyid=1 poluuid="b5737652-bee5-51ef-068b-5b2ac0dd2b1a" policytype="policy" sessionid=881178 srcip=192.48.1.2 srcport=49504 srccountry="United States" srcintf="port3" srcintfrole="undefined" srcuuid="5465ab26-b41a-51ef-cce7-1754ece7dc2c" dstip=160.153.61.67 dstport=443 dstcountry="United States" dstintf="port1" dstintfrole="undefined" dstuuid="5465ab26-b41a-51ef-cce7-1754ece7dc2c" proto=6 service="HTTPS" hostname="rabudiagnostic.com" profile="Clone of default" action="passthrough" reqtype="direct" url="https://rabudiagnostic.com/" sentbyte=2016 rcvdbyte=0 direction="outgoing" msg="URL belongs to an allowed category in policy" ratemethod="domain" cat=33 catdesc="Health and Wellness"  Debug commands: diagnose debug reset diagnose ips debug disable all diagnose ips filter clear diagnose ips filter set "host <client-ip>" diagnose ips debug enable urlfilter diagnose debug enable [3500@22648]urlf_query_fgd: id:2216 sess:22648 action:0 error:0 src:2 host:rabudiagnostic.com url:/ rate_ip:0 ssl_exemption_query:0 [3500@22648]handle_fgd_answer: sess:22648, id:0, action:1, resume:0, error:0, ftgd_category:61, url_category:61, local_category:0, byip:0, log:1, time:0s [3500@22648]on_rating_done: sess 22648, rate 61, action 1 [3500@22648]ips_eng_log_webfilter: sess:7304496 type:10 action:1 host:rabudiagnostic.com source:2 url:/ [3500@22648]ips_set_pkt_urlf_verdict: action=DROP   Related article: Technical Tip: How to narrow down specific logs from CLI of the FortiGate