Web filter

[karthik]

Hi,

Our current fortinet 100d web guard filter license has expired. is it possible to block https facebook & youtube without fortiguard web filter?

[gschmitt]

I just tested it with my demo device, the URL Filter doesn't seem to work without a valid license BUT an Application Filter works

[FatalHalt]

gschmitt wrote:

I just tested it with my demo device, the URL Filter doesn't seem to work without a valid license BUT an Application Filter works

While this should work, it's worth noting now that your license is expired, these signatures will start becoming out of date. If the traffic used to identify Facebook in the application control engine changes significantly, it could no longer work. 

[karthik]

Hi,

Can you tell me how to do that?

[gschmitt]

karthik wrote:

Can you tell me how to do that?

Go to Security Profiles > Application Control (if this is missing you need to enable the feature at System > Config > Features)

Below Application Overrides hit Add Signatures

Search for Facebook/Youtube, select the Signatures and hit Use Selected Signatures

Make sure the Action is set to Block

Hit Apply

Go to Policy&Objects > Policies > IPv4 and look for your Internal > wan policy which is used for every day browsing

Double click it, activate Application Control to ON (make sure the right profile is enabled if you have Multiple Security Profiles on) and hit Apply

[neonbit]

Hi Karthik,

You can block https facebook and youtube by using the URL filters which don't require the webguard license.

In the webfilter profile disable the 'FortiGuard Categories' and enable the 'URL Filter'. Add the URLs you want to block and ensure the action is 'Block'.

It's a little messy as you'll need to ensure all URL matches you want to block have been added.

My recommendation is to renew your web filtering license :)