Hi,
I am not sure if I am hitting a bug as always. I am trying to using basic url-filtering in the new flow mode in 5.6. Latest firmware GA version.
policy-1 allow service dns & icmp
policy-2 allow service http/https, no application, allow certain URL-categories (log)
policy-3 deny service http/https, no application, blocked certain categories (log)
policy-4 deny all
Under logs and reports in web-filter there is no logs. traffic is getting denied or permitted based on applications though I have not used them in the policy.
does this thing really work as mentioned.
has anyone got web-filtering to work in FortiOS 5.6 in flow mode. Please help.
Sebastan
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I have to agree with roman, I would avoid any critical NGFW features in v5.6.x . This is really a " try and hope it works" and YMMV. Back on the logging, I did NOT seen URL logs either even tho my sites where blocked. I didn't spend too much time since I got home late. I'll try more actions this weekend.
Ken
PCNSE
NSE
StrongSwan
Hi ken,
You can see the logs details and it will show you that the blocking is because of an app-ctrl event and not web-filter event. So it's pretty obvious that web filtering is not working in NGFW mode for sure no matter what you try.
Sebastan
What do yo have on your fwpolicy ?
Can you do a cmd show firewall policy <####> ?
PCNSE
NSE
StrongSwan
Hi Emnoc,
below are the firewall policies
Show firewall policy 5 config firewall policy edit 5 set name "Allow-DNS & ICMP" set uuid 35d302de-0ad1-51e8-97eb-69e7544dfe32 set srcintf "Lan" set dstintf "Wan" set srcaddr "Lan" set dstaddr "all" set action accept set schedule "always" set service "DNS" "ALL_ICMP" set logtraffic disable show firewall policy 7config firewall policy edit 7 set name "Allow-Web" set uuid c87d5c94-2311-51e8-687d-74e995853e25 set srcintf "Lan" set dstintf "Wan" set srcaddr "Lan" set dstaddr "all" set action accept set schedule "always" set service "ALL" set logtraffic all set url-category 24 25 23 There is an implicit deny rule with logging enabled. if possible please try to replicate the same and you will see the traffic which is blocked by the deny rule the event is application control and not web-filter. I even tried using the url-webfilter in the filter for displaying logs and there will be no logs. but you can see the same logs when the filter is set to app-ctrl for logs. Sebastan
I want to give this somewhat older post a bump. Has this ever been resolved or clarified? I am wondering because I have the exact same issue and I am already on FortiOS 6.0.2. I can't believe (in case this is actually a bug) that this hasn't been fixed by now?
Just to clarify: I am not seeing any web filter logs, same set up as the original poster. Policy violations are logged in the normal forwarding log without any hint at web filtering (doesn't mention the URL), while at the same time stuff appears in the application control log (there are not app filter policies enabled).
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1516 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.