Unable to get to site that I have allowed

[mkratel]

DISCLAIMER: I'm new to firewall administration and FortiGate products as a whole.

Our users are unable to access any state government websites, ending with the state domain name, hawaii.gov. We don't have any rules explicitly blocking these sites or this domain, and I have added rules in the FortiGate to explicitly allow them. Here are the steps I've taken so far:

[ul]

Under Policy & Objects, I've created an FQDN Wildcard for the *.hawaii.gov domain

Under Security Profiles, Web Filter, I've created a Static URL Filter to allow *.hawaii.gov as a wildcard, as well as added the full web address as a Simple.

Under Security Profiles, DNS Filter, I've created a Domain Filter for *.hawaii.gov as a wildcard, as well as added the full web address as a Simple.[/ul]

None of this would allow us to get to the website, until I specifically added the IP address and DNS name of the website in the computer's hosts file.

What am I missing?

[Toshi_Esumi]

Sounds like DNS filter is blocking it, not web filtering. To start, create a simple policy with the wildcard FQDN (assuming 6.2.2 or above) as destination then service: DNS, HTTP/HTTPS, and allow for the action without any protection profile. Place it at the top of the policies. Make sure this works.

Then you can start adding those DNS filter then Web filter and others, one by one. With that way, you can know what is causing the block, and go back one step then tweak the profile.

Or, more direct method is to run "flow debug" by searching how to do it on the internet, or in the forum, to see the direct cause of blocking.

[emnoc]

agreed and i would double check the fqdn list

e,g. diag firewall fqdn list | grep haw

Ken Felix