add massive urlfilter on fortiOS 7.2.X

[papapuff]

hi there,

I need help please.

I need to add many url list to be allowed. so I plan to use urfliter inside webfilter profie (existing webfilter profile).

rather than to add one by one, it takes time. is there a way to copy - paste to CLI to add urlfilter for existing webfilter profile that already have some urlfilter as well?

if yes, please help.

I use FG60F with forti OS 7.2.4

by the way I've try use web rating by create new rating category and put all url insde that category.

use webfilter profile activate fortiguard based category, block all categories except the new one. and inside that webfilter profile also has urlfilter active.

but somehow all url inside urlfiter keep blocked because some of them refer to existing fortiguard web rating category. I expected all url listed in urlfilter will override setting on fortiguard webbased category.

thank you

[Toshi_Esumi]

Assuming you have just one webfilter profile with some urlfilters already. Then it's relatively simple. First you should take a look at the current config in CLI and learn the structure of the related part of the config.
Get in CLI and go to below. Then you should see something similar to below:

FortiWiFi-60E # config webfilter profile

FortiWiFi-60E (profile) # edit ?
*name Profile name.
default
monitor-all
sniffer-profile
testWebProfile
wifi-default

With this example, I created "testWebProfile".

 

FortiWiFi-60E (profile) # edit testWebProfile

FortiWiFi-60E (testWebProfile) # show
config webfilter profile
  edit "testWebProfile"
    config web
      set urlfilter-table 1
    end
    config ftgd-wf
      unset options
      config filters
        edit 1
          set category 2
          set action warning
        next
        edit 2
--[ snip ]--

So it's using urlfilter-table "1".

FortiWiFi-60E (testWebProfile) # end

FortiWiFi-60E # config webfilter urlfilter

FortiWiFi-60E (urlfilter) # show
config webfilter urlfilter
  edit 1
    set name "test-urlfilter1"
    config entries
      edit 1
        set url "*.toshiesumi.us/test1"
        set type wildcard
        set action block
      next
    end
  next
end

I created an urlfilter "*.toshiesumi.us/test1" as "wildcard" then set action to "block".

You just need to add all entries below existing entries. That means you just need to create a text script like below to add after that.

config webfilter urlfilter
  edit 1
    config entries

      edit 0

        set url "*.toshiesumi.us/test2"
        set type wildcard
        set action exempt   <-- this is the default value if you don't specify
      next

      edit 0

        set url "*.toshiesumi.us/test2"
        set type wildcard
        set action monitor

      next

  --[snip]--

    end

 next 

end

Then paste this script into the CLI prompt at the top hierarchy. But I would suggest you manually type the first a couple of entries to see how it goes. Then once you are confident with the script, you can paste the rest. Make sure you use "edit 0" for those entries, which would set the next avilable entry number like "2" automatically, and all "spaces" for the indentation. Don't use "tab", which likely break some part. FGT CLI doesn't like tabs.

Toshi