Webfiltering jumps into overdrive for no discernible reason

[ikmarwright]

The other day our LAN to WAN webfiltering started blocking about 80% of sites. The last change to the firewall had happened about 16 hours earlier, but nothing that should have blocked banking sites or duckduckgo.

I had to turn off webfiltering until I could reboot the firewall. Since I rebooted (with the same webfiltering active again), I've had no problems.

This is a 100D running 6.0.9 on voltage regulating UPSs.

Just curious if this had happened to anyone else. 

Dave

[TecnetRuss · Accepted solution]

We've recently seen a spike in "Web Page Blocked: an error occurred while trying to rate the website using the web filtering service" messages both internally and complaints about this from customers.  These show up in the Web Filter log as "Action: Blocked, Message: A rating error occurs".

I opened a support ticket and here's what we narrowed this down to:

[ul]

FortiGates running FortiOS 6.0.8 and 6.0.9 (and probably 6.2.x too but not tested)

System / FortiGuard / Protocol = HTTPS (as per 6.0.8/6.0.9 release notes guidance)

Switching Update Server location from "US only" to "Lowest latency" or Port from 8888 to 53 or vice-versa sometimes temporarily resolved the problem but the "ratings error" returned.[/ul]

If you run "diag debug rating" with the above settings you'll see that there are fewer FortiGuard servers available that respond over HTTPS compared to HTTP or UDP.  This seems to be a recent capacity issue but support hasn't confirmed this.  We had FortGuard over HTTPS enabled soon after FortiOS 6.0.8 came out and it ran for months without issues - until recently.

If you set System / FortiGuard / Protocol to UDP you should find that the ratings errors go away and normal, reliable web filtering resumes.  Our other option to avoid the block pages is to modify our Web Filtering profile to "Allow websites when a rating error occurs" (i.e. fail open), but I'd recommend against this as it potentially allows pass-through to malicious sites when rating fails.

If this is exactly what you're seeing I'd recommend you open a case with support.  Hopefully this gets resolved soon so we can switch back to the more secure FortiGuard over HTTPS.

Russ

NSE7

[ikmarwright]

Thanks, Russ.

What's weird is it was the quietest office day we'd had in months. Only two users were in the office at the time and our website is offsite. And the websites blocks weren't logging either.

Regardless I'll double check my FortiGuard protocol tomorrow.

Dave

[TecnetRuss]

Yes, very similar to us - the very first time we noticed it was at 7:00 PM when there were only a few people in the office.  It is sporadic enough in our office that I've left our FortiGate in HTTPS mode for FortiGuard and our staff just know to hit refresh a few times and the ratings error goes away, but for bigger customers it is too disruptive and we had to ensure FortiGuard was using UDP to avoid the user complaints.

Russ

NSE7

[cashrewards]

Same issues here, we are getting some of the Business websites is getting blocked like LinkedIn, WebFilter setting looks fine for me. Is there anything else I have to check in my settings? 

[ShawnZA]

On my home 60E on 6.2.3 I have this today...

When I go to Web Rating Overrides I am greeted by this message:

Cannot lookup rating as the Webfilter service is currently not running. Select a Webfilter profile in a firewall policy in order to start the service.

(Rebooted the 60E remotely now, never came back up, will check what happened when I get home)

And production 300D on 6.2.2:

When I go to Web Rating Overrides I am greeted by this message:

FortiGuard rating unavailable.

[ikmarwright]

Just as a follow up. We were (and are) using UDP already when we had the problem. 

I've never seen the errors that ShawnZA received.

Update: Had the problem a second time. Set FortiGate to HTTPS, Applied then setup back to UDP. Good to go.