Hello guys!
I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Created on 04-22-2023 10:13 PM Edited on 04-22-2023 10:22 PM
here the access is not blocked based on url rating but based on IP rating.
dstip=157.240.222.60
ratemethod=ip
And the IP is rated under social networking, and hence should be blocked.
best regards,
Jin
Hi,
Could you please post the raw log? If web.whatsapp.com is detected by urlfilter, it should have been categorized as webchat, but may be application control detects it as social networking category.
best regards,
Jin
Created on 04-19-2023 03:48 AM Edited on 04-19-2023 03:55 AM
Hello, Kin! I'm not using any app control on my police.
date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=1xx.xx.1xx.xx dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=xxxxxxxxxx group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-j... hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=000000000 vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all
cannot read the logs
Created on 04-19-2023 04:23 AM Edited on 04-19-2023 06:00 AM
Hello, Jin!
date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=XXX.XX.XX.XXX dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-j... hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all
Created on 04-19-2023 04:31 AM Edited on 04-19-2023 06:00 AM
..
the logs dont show the url belonging to web chat category inorder to allow. the url seen here is pps.whatsapp.net
best regards,
jin
Jin, pps.whatsapp.net is the url of whatsapp app running on a windows desktop, but is the same problem with the url web.whatsapp.com. Please, see the following raw log:
date=2023-03-21 time=15:30:54 id=7213068811073749046 itime=2023-03-21 15:30:54 euid=12697 epid=1206 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=179721645 policyid=41 srcip=XXX.XX.XXX.XXX dstip=157.240.222.60 srcport=53029 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1679423454318969117 sentbyte=1239 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=direct url=https://web.whatsapp.com/ hostname=web.whatsapp.com profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-03-21 15:30:54 itime_t=1679423454 srcuuid_name=Sede_Netw dstuuid_name=all
...
.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.