Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
pblazey
New Contributor

Web filter Allow vs Exempt

Hi team,

 

NSE4 trainee here. Just trying to understand the functional real world difference between Allow and Exempt in the Web Filter. I understand that Allow continues through the remainder of the security profiles such as AV, IPS, Fortiguard web filtering etc whereas Exempt passes any further security inspection. 

 

What I don't understand is a situation where allow would actually do anything compared to exempt. In my experience, when a client requests for a URL to be whitelisted, the URL is already blocked by Fortiguard. When I select "Allow", it goes through normal "Web Filtering", which it passes due to the allow rule, but then is blocked by Fortiguard web filtering. When I select "Exempt", it passes through Fortiguard Web Filtering and any remaining security filters.

 

What is the use case for the "Allow" rule? When would the rule actually allow traffic? What else would be blocking the web traffic except for the Fortiguard web filter? Also, it's annoying that there's no inbetween - either bypass nothing or bypass Fortiguard web filter and every other security profile.

 

I'm sure that I'm missing something here, just looking to understand the answer

4 REPLIES 4
jdelafuente_FTNT

Allow: Traffic is oassed to remaining operations, includin FortiGuard web filter, web content filter, web scripts filters and av scanning.
Exempt: Allow traffic from tusted sources to BYPASS all security inspections

More info: 
https://training.fortinet.com/ NSE4-Security Lesson 29.

Jonathan De La Fuente | LATAM TAC Engineer
pblazey
New Contributor

Hi Jonathan,

 

I've done that training and I was aware of the order of operations.

 

My question was relating to the allow rule's functionality. What is the use case for allow? When would "allow" actually allow something past the web filter without it then hitting the fortiguard web filter and being blocked?

jdelafuente_FTNT

Check this out:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Difference-between-action-Allow-and-Exempt...

 

Best regards

Jonathan De La Fuente | LATAM TAC Engineer
jdelafuente_FTNT
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors