Webfilter doesn't work if access goes through google search with internet explorer.

[rezendecs]

Webfilter doesn't work if access goes through google search with internet explorer. 

If the user try access youtube.com using google search with chrome, the webfilter work and the access is denied, but if the same access is with internet explorer the access is allowed.

Look the log file attached...

Fortigate 100D

5.0.9

Regards,

Claudio

[jb_kalm]

Hi, can you send a screenshot of the log when the traffic is blocked as well?

Thanks,

jb

[rezendecs]

Yes,

   Look the file attached.

Regards,

Claudio

[ashukla_FTNT]

Run wireshark on pc from where you are doing the test.

Look at http get to the google server and check if it is different from the blocked one using chrome.

You can also post the http get here.

[jb_kalm]

Sorry for duplicate post.

Thanks,

jb

[jb_kalm]

Hi, thanks for the screenshot. These are my thoughts. If you look at the URL on the blocked log message it is going to gdata.youtube.com which is blocked on your webfilter config. However when a user searches through Google and they click on a link for youtube it most likely takes them to https://www.youtube.com. If you don't have SSL inspection turned on and configured your webfilter will not be able to block it. Do you have SSL Inspection turned on and configured?

Thanks,

jb

[rezendecs]

Hi JB,

  Yes, I have ssl inspection enabled.

  Curious is that in chrome the webfilter work fine, just with IE the problem happen.

Regards,

Claudio

[jb_kalm]

Hi Claudio,

I'm wondering if it could be a caching issue. Can you clear the cache on the web browser having the issue and try again? Is it just one computer or all computers?

Thanks,

jb

[jb_kalm]

Also how do you have this configured at the moment?

Rate URLs by Domain and IP Address:

http://docs-legacy.fortin...er_chapter.154.55.html

[thierry2208]

Hi,

I have the same issue on my Fortigate110C ver 5.2.2

The problem appears with google searches through IE and Mozilla. It's working fine with Chrome

The returned URL (for example search on site voiceprep.nl) give the following as %%URL%% variable for system message replacements:

IE: http://www.google.lu/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&sqi=2&ved=0CB8QFjAA&url=http%3A%2F%2Fvoicepre...

Mozilla: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCUQFjAA&url=http%3A%2F%2Fvoiceprep.nl%...

but Chrome returns: voiceprep.nl/ 

If you change the searched URL in IE and Mozilla from HTTP to HTTPS then the filtered message return the corret URl value = voiceprep.nl/

Did anybody find out how to fix or bypass this problem?

Cheers

Thierry2208