no web filtering and no web-filtering logs in fortiOS 5.6 in flow mode

sebastan_bach · ‎03-08-2018

Hi,

I am not sure if I am hitting a bug as always. I am trying to using basic url-filtering in the new flow mode in 5.6. Latest firmware GA version.

policy-1 allow service dns & icmp

policy-2 allow service http/https, no application, allow certain URL-categories (log)

policy-3 deny service http/https, no application, blocked certain categories (log)

policy-4 deny all

Under logs and reports in web-filter there is no logs. traffic is getting denied or permitted based on applications though I have not used them in the policy.

does this thing really work as mentioned.

has anyone got web-filtering to work in FortiOS 5.6 in flow mode. Please help.

Sebastan

emnoc · ‎03-09-2018

I have to agree with roman, I would avoid any critical NGFW features in v5.6.x . This is really a " try and hope it works" and YMMV. Back on the logging, I did NOT seen URL logs either even tho my sites where blocked. I didn't spend too much time since I got home late. I'll try more actions this weekend.

Ken

PCNSE

NSE

StrongSwan

sebastan_bach · ‎03-09-2018

Hi ken,

You can see the logs details and it will show you that the blocking is because of an app-ctrl event and not web-filter event. So it's pretty obvious that web filtering is not working in NGFW mode for sure no matter what you try.

Sebastan

emnoc · ‎03-09-2018

What do yo have on your fwpolicy ?

Can you do a cmd show firewall policy <####> ?

PCNSE

NSE

StrongSwan

sebastan_bach · ‎03-09-2018

Hi Emnoc,

below are the firewall policies

Show firewall policy 5

config firewall policy

edit 5

set name "Allow-DNS & ICMP"

set uuid 35d302de-0ad1-51e8-97eb-69e7544dfe32

set srcintf "Lan"

set dstintf "Wan"

set srcaddr "Lan"

set dstaddr "all"

set action accept

set schedule "always"

set service "DNS" "ALL_ICMP"

set logtraffic disable

show firewall policy 7

config firewall policy

edit 7

set name "Allow-Web"

set uuid c87d5c94-2311-51e8-687d-74e995853e25

set srcintf "Lan"

set dstintf "Wan"

set srcaddr "Lan"

set dstaddr "all"

set action accept

set schedule "always"

set service "ALL"

set logtraffic all

set url-category 24 25 23

There is an implicit deny rule with logging enabled.

if possible please try to replicate the same and you will see the traffic which is blocked by the deny rule the event is application control and not web-filter. I even tried using the url-webfilter in the filter for displaying logs and there will be no logs. but you can see the same logs when the filter is set to app-ctrl for logs.

Sebastan

cryptochrome · ‎08-10-2018

I want to give this somewhat older post a bump. Has this ever been resolved or clarified? I am wondering because I have the exact same issue and I am already on FortiOS 6.0.2. I can't believe (in case this is actually a bug) that this hasn't been fixed by now?

Just to clarify: I am not seeing any web filter logs, same set up as the original poster. Policy violations are logged in the normal forwarding log without any hint at web filtering (doesn't mention the URL), while at the same time stuff appears in the application control log (there are not app filter policies enabled).