Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
therculano
New Contributor III

Web Filter - Wrong categorization

Hello guys!

 

I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?

Thiago Herculano
Thiago Herculano
1 Solution
jintrah_FTNT

here the access is not blocked based on url rating but based on IP rating. 

 

dstip=157.240.222.60

ratemethod=ip

 

And the IP is rated under social networking, and hence should be blocked.

 

best regards,

Jin

View solution in original post

12 REPLIES 12
jintrah_FTNT
Staff
Staff

Hi,

 

Could you please post the raw log? If web.whatsapp.com is detected by urlfilter, it should have been categorized as webchat, but may be application control detects it as social networking category.

 

best regards,

Jin

therculano

Hello, Kin! I'm not using any app control on my police.

date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=1xx.xx.1xx.xx dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=xxxxxxxxxx group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-j... hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=000000000 vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all

 Screenshot_3.png

Thiago Herculano
Thiago Herculano
rockstar

cannot read the logs

therculano

Hello, Jin!

date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=XXX.XX.XX.XXX dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-j... hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all

Thiago Herculano
Thiago Herculano
therculano

..

Thiago Herculano
Thiago Herculano
jintrah_FTNT

the logs dont show the url belonging to web chat category inorder to allow. the url seen here is pps.whatsapp.net

 

best regards,

jin

therculano

Jin, pps.whatsapp.net is the url of whatsapp app running on a windows desktop, but is the same problem with the url web.whatsapp.com. Please, see the following raw log:

date=2023-03-21 time=15:30:54 id=7213068811073749046 itime=2023-03-21 15:30:54 euid=12697 epid=1206 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=179721645 policyid=41 srcip=XXX.XX.XXX.XXX dstip=157.240.222.60 srcport=53029 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1679423454318969117 sentbyte=1239 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=direct url=https://web.whatsapp.com/ hostname=web.whatsapp.com profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-03-21 15:30:54 itime_t=1679423454 srcuuid_name=Sede_Netw dstuuid_name=all

Thiago Herculano
Thiago Herculano
therculano
New Contributor III

...

Thiago Herculano
Thiago Herculano
therculano
New Contributor III

.

Thiago Herculano
Thiago Herculano
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors