Wrong categorization

[therculano]

I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?

Please, see the following raw log:

date=2023-03-21 time=15:30:54 id=7213068811073749046 itime=2023-03-21 15:30:54 euid=12697 epid=1206 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=179721645 policyid=41 srcip=XXX.XX.XXX.XXX dstip=157.240.222.60 srcport=53029 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1679423454318969117 sentbyte=1239 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=direct url=https://web.whatsapp.com/ hostname=web.whatsapp.com profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-03-21 15:30:54 itime_t=1679423454 srcuuid_name=Sede_Netw dstuuid_name=all

The same problem happens to whatsapp app: 

date=2023-04-17 time=11:04:22 id=7223019425664860162 itime=2023-04-17 11:04:22 euid=1374 epid=1120 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=211324555 policyid=41 srcip=XXX.XX.XX.XXX dstip=157.240.222.60 srcport=58297 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1681740261632323397 sentbyte=1400 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing ratemethod=ip reqtype=referral url=https://pps.whatsapp.net/v/t61.24694-24/55963542_277213743227349_7903084543010144256_n.jpg?stp=dst-j... hostname=pps.whatsapp.net profile=SPO_ProPlus agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 catdesc=Social Networking eventtype=ftgd_blk srcintf=internal dstintf=wan1 referralurl=https://web.whatsapp.com/ authserver=FSSO_Sede msg=URL belongs to a denied category in policy tz=-0300 srcuuid=fa706ed8-e025-51eb-8560-a301a75a14c7 dstuuid=68e8adce-e00f-51eb-9b17-0ae1d29d7931 policytype=policy srccountry=Reserved dstcountry=Brazil poluuid=af1634f8-6a6d-51ed-6089-03b21c5ecf38 httpmethod=GET devid=XXXXXXXXXXXXXX vd=root dtime=2023-04-17 11:04:22 itime_t=1681740262 srcuuid_name=Sede_Netw dstuuid_name=all

[gfleming]

Looking at Fortiguard website, web.whatsapp.com has never been officially categorized by FG as Social Networking. Look at the history.

https://www.fortiguard.com/webfilter

So this isn't a problem where you might have outdated web filter package from FG.

This is most likely a local configuration issue. Can you try creating a new Web Filter profile and a new FW Policy for testing and see what happens?

Also please review all of your overrides to make sure there is no conflicting config.

[therculano]

Graham, I just found out that: "The FortiGate does not download the Webfiltering database. The database is located in the cloud and your FortiGate sends live web category queries to the cloud." 

Solved: How do I see what Web Filter database version we a... - Fortinet Community

Using the commands: 

diagnose debug enable
diagnose debug authd fsso list

I can see the problematic user is under the right group and the right webfilter policy. The raw log indicates that is blocking under the right fw policy but for the wrong reason. As soon as possible I will make a new webfilter policy and a new fw policy to test. 

Thanks! 

[lol · Accepted solution]

Hello,

> The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat

Per log file the interesting parts are
dstip=157.240.222.60
ratemethod=ip
hostname=web.whatsapp.com

While the FQDN web.whatsapp.com is rated as Category: Web Chat
the IP 157.240.222.60 is rated as Category: Social Networking

Because you have configured the rating method as IP the matched category is Social Networking.

In the webinterface the setting is "Rate URLs by domain and IP Address".
In the CLI it is called

config webfilter profile
edit "test"
...
config ftgd-wf
set options rate-server-ip <-----

> The same problem happens to whatsapp app:

Per log:
dstip=157.240.222.60
ratemethod=ip
hostname=pps.whatsapp.net

Same applies here.
The FQDN is rated as Category: Instant Messaging

While the IP is marked as Category: Not Rated.

---> To resolve this you could disable the feature to rate by IP address and only rely on the actual FQDN being accessed.

For the ratings check here https://www.fortiguard.com/webfilter.

Regards

[therculano]

Dear, you went just to the point! That is it! It is working properly now! Thank you very much!