Web Filter - Wrong categorization

[therculano]

Hello guys!

I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?

[jintrah_FTNT]

Hi,

Could you please post the raw log? If web.whatsapp.com is detected by urlfilter, it should have been categorized as webchat, but may be application control detects it as social networking category.

best regards,

Jin

[therculano]

Hello, Kin! I'm not using any app control on my police.

date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=1xx.xx.1xx.xx dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=xxxxxxxxxx group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-j... hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=000000000 vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all

 

 

[rockstar]

cannot read the logs

[therculano]

Hello, Jin!

date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=XXX.XX.XX.XXX dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-j... hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all

[therculano]

..

[jintrah_FTNT]

the logs dont show the url belonging to web chat category inorder to allow. the url seen here is pps.whatsapp.net

best regards,

jin

[therculano]

Jin, pps.whatsapp.net is the url of whatsapp app running on a windows desktop, but is the same problem with the url web.whatsapp.com. Please, see the following raw log:

date=2023-03-21 time=15:30:54 id=7213068811073749046 itime=2023-03-21 15:30:54 euid=12697 epid=1206 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=179721645 policyid=41 srcip=XXX.XX.XXX.XXX dstip=157.240.222.60 srcport=53029 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1679423454318969117 sentbyte=1239 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=direct url=https://web.whatsapp.com/ hostname=web.whatsapp.com profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-03-21 15:30:54 itime_t=1679423454 srcuuid_name=Sede_Netw dstuuid_name=all

[therculano]

...

[therculano]

.