Web Filter

[HS08]

Hello,

I have complain from user that they have application but not running, after i do investigation by remove web filtering from the policy the application is running. 

Then i make a new web filter and set all categories to 'enable' and apply to the policy, and unfortunately the application didn't work anymore, then i remove again this web filter from the policy and the application running back.

So here i want to know if there any difference between we set all categories on the web filter to enable then apply to the policy with no web filter on the policy?

[abarushka]

Hello,

I would recommend to check web-filter logs and rating errors. Moreover, I would like to ask what action is set for web-filter category.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Web-Page-Blocked-An-error-occurred-while-t... (rating error)

[HS08]

Hello,

'Allow Websites When a Rating Error Occurs' not helping, the app still not work

[chauhans]

Hello @HS08 
As I understand that once you are removing security profiles from the firewall policy, the application is opening.
+ Kindly navigate to Logs&Reports>>Filter it by the source IP>>and check the action, wherein you will see the reason of the application getting blocked.
+ If you are aware of application fqdn, kindly please follow below steps.
+ Please navigate to Security profiles>Web rating overrides>type the URL and do a lookup for the rating and check the application is falling under which category.
+ Once you will identify the category, make sure that category is being allowed from the application control profile.
+ Moreover, please navigate to Logs&Rports>>Security events>>Application Control>>Filter it by the IP and check the relevant logs for the application getting blocked.

Thanks.

[HS08]

Hello,

As i already mention, I already create a new web filter with all categories set to 'Allow' but the app still can't work except the are no web filter on the policy.

[tthrilok]

Hi HS08,

From the below statement, I understand you are speaking about enabling the Fortiguard categories in webfilter profile:

So here i want to know if there any difference between we set all categories on the web filter to enable then apply to the policy with no web filter on the policy?

>> When you enable the Fortiguard Categories in the Webfilter and called the webfilter profile in the policy, firewall before allowing your website traffic, first it verifies the category of the website with Fortiguard and then takes the action based on the category action you defined in the webfilter. 

>> When you do not call any webfilter profile in the policy, firewall doesn't do the above mentioned process, but just allows the traffic.

Now in your sceanrio, you are not able to access the web application when enabling the webfilter profile in the policy. For this, we need to check what is the category of the website, and then you may allow the category, of whitelist it by configuring a URL filter.

>> https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-a-static-URL-filter-feature-to-allow...

you may follow the above and configure the URL which your client is using to access the web application, and set the action as exempt, and test.

NOTE: Let us know if we misunderstood the statement.

Thank you!

Thallapelly Thrilok.

[vsahu]

Hello HS08,

Firstly can you let me know which application the access is not working (Application Name)?

As you mentioned even after allowing all the categories the application is blocking it seems unexpected as everything is allowed, the only possibility I can think of is the web rating not working correctly.

To verify it can you confirm this issue is happening with the specific application? are you able to access other sites without any issues? Also, the web filter should not cause issues with the application as it verifies the traffic based on FQDN.

Can you share the output of the policy, web filter, and SSL/ssh profile configured for the application access.

show firewall policy <id>
show webfilter profile

show webfilter urlfilter

show firewall ssl-ssh-profile

diag debug rating