Fortiguard Intrusion prevention - access blocked

[kamal1]

we having problem with webpage blocked periodically by forti guard.

we notice that username and group name is blank.

 

[Shilpa1]

Hello kamal1,

Please check if the action for the category 'search engines and portals'  in the web filter profile set to block.

Or

If you are using proxy-based inspection mode, try changing it to flow mode and have a check.

Regards,
Shilpa C.P

[mzainuddinahm]

Hello Kamal1,

Most of the times the Username & Group Name are retrieved from FSSO config on your Fortigate, so if it is a local user then most probably it will return blank values. Kindly check the policy details & the UTM filters applied to it to narrow down the issue. Also, forward traffic log will help in identifying the source IP of the user for this traffic.

Regards,

Mohammed Ahmed