Problem with website blocked, even after exclusion created

[albaker1]

We have some Ubuntu hosts that need access to a site for updates, and on a "Permit Outbound Web Traffic" rules that includes both 443/tcp and 80/tcp, and there are blocks because of UTM. Specifically, the "Threat Type" is "N/A -Static URL Filter." I put an exclusion in (the FortiManager, running 7.2.8) for the FortiGate (also running 7.2.8) within the Security Profiles > Web Filter for wildcard *.ubuntu.com*, but the block persisted. I then put one in for "connectivity-check.ubuntu.com," which is the first site the hosts try to reach. The blocks continued on. I created a rule to exclude that subnet from the Web Filter, and it works. 

I'm at a loss as to why the firewall is behaving this way, and I also can't figure out what "N/A - Static URL Filter" really means in context with the Web Filter. I need to fix this rule, so any help in resolving this would be greatly appreciated.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[AEK]

Has the profile been correctly pushed to the FGT? Can you share a screenshot from the FGT?

Do your clients use legacy DNS (UDP) or DNS over TLS/HTTPS?

[albaker1]

It has indeed been pushed:

They use 53/udp for DNS to our internal AD servers.

We have other exclusions that are working properly, and I've attempted various iterations for Ubuntu with no success.

[funkylicious]

can you show the whole log where the traffic appears blocked ?

[AEK]

The filter seems correct on the FortiGate. As requested by Funkylicious, try redo the test (i.e.: access ubunto.com via your browser or wget) then share the traffic logs and UTM logs that show denied access to ubuntu site.

You can also debug the traffic for extra information:

diag debug flow filter addr x.x.x.x   (your client's IP)
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 200
diag debug enable