Static URL Exception not allowing remote content in page source

[BoarexTech]

Hi all,

We are looking to implement web content filtering on our firewalls and have encountered a 'issue' as such I was wondering if any one can please advise us on.  Sorry for the long post but want to give all of the details. During my test I configured the relevant web filtering profile, SSL inspection profile, policy ETC which all works fine. I then set the social network catagory on the web filtering profile assigned to my policy which in turn blocks the website from loading in the policys targeted clients. Fantastic. My problem comes when I want to set a temporary static URL filter to allow a certain website (which we will need to do very frequently in one of our offices in production). So I set a static wildcard filter to exempt *facebook* then apply. I then hit 'www.facebook.com' on a targeted client and the website loads but incorrectly. The formatting and background images are missing. On closer inspection I notice that there are javascripts nested in the page source which point to a different remote location to load the CSS stylesheets and images for the website, of which the remote location is blocked in a different web filter. As I mentioned before, this posses a problem for us when we need to temporarily allow certain websites which are blocked in categories and makes the web filter completely impractical for the way we operate, as with a vast majority of websites on the internet these days they will all load remotely hosted content within their code which may not always be located at the same location/URL as the primary site. Is anyone able to advise on how I can work around this or whether I am missing something?  :(

Thanks!

[Dave_Hall]

A possible quick and dirty solution would be to reclassify the site under either another allowable category or choose the custom# category.    (If choosing the custom category make sure you set that category to allow under your web filter/FortiGuard profile).

[Adrian_Buckley_FTNT]

If you look at the logs, that category/URL is being blocked to prevent loading of those Style sheets and Java?

Usually if a website behaves that way it's because the main site is allowed (Facebook for example) and the display data is store on different hostnames that belong to a different (blocked category).

[BoarexTech]

Yes that is exactly the issue, style sheets and images are being blocked that are hosted on remote servers within the page source which are published on a URL in a blocked category.  I was wondering if there is any way around this but after investigating it doesn't look like it.

Thanks

[Adrian_Buckley_FTNT]

It boils down to the interaction between the design of the website and the categories you've chosen to block.

You can't change the design of the website so then you'll need to decide how to make it display properly.

i) Don't block the category causing the problem

       - Maybe whatever category you've chosen to block isn't worth it

ii) Use FortiGuard rating overrides to allow that domain

       - The only problem with this is they only work with hostnames, not the full URL so you may allow more then you would prefer

iii) Use an EXEMPT action in the URL filter list

       - URL Filter list allows you to do the exact URL, which is better IF it never changes

       - EXEMPT bypasses ALL further check, including AV.  You can adjust it in the CLI so you only bypass the FortiGuard check