I have two fortigate 90d's both running v6.0.17 build0528 (GA)
I have configured the default web filters identically and applied to the policies
However, on one 90D it will block all the wildcard url's I enter but the other only does work
I also see on the 90D that is not working correctly that I have and can configure more web filter profiles while on the 90D that works, I can only edit the default web filter profile.
I have tried to compare configs between the two 90D's but I can not see anything related that is different.
None of the units have FortiGuard licenses or the option selected
Are there any global commands I should look at?
Any ideas or areas to look at would be appreciated
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello londonnet, Good day!
Thank you for reaching us.
Can you please share the web-filter and firewall policy CLI output from two FortiGates here? Please mention which one of them is working and also don't forget to hide the sensitive information.
Please be advised that 6.0.x is Out of support. Could be a bug that cannot be fixed on that branch.
thank you!
This is the config on the unit that works
config webfilter urlfilter
edit 1
set name "default"
config entries
edit 1
set url "*web1.co.uk"
set type wildcard
set action block
next
edit 2
set url "*web2.co.uk"
set type wildcard
set action block
next
edit 3
set url "*web3.com"
set type wildcard
set action block
next
edit 4
set url "*web4.co.uk"
set type wildcard
set action block
edit 8
set name "test1"
set uuid xxxxx
set srcintf "wifi"
set dstintf "wan1"
set srcaddr "1"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set utm-status enable
set logtraffic disable
set fixedport enable
set fsso disable
set av-profile "default"
set webfilter-profile "default"
set ssl-ssh-profile "certificate-inspection"
set nat enable
And this is the config on the unit that doesn't work but please remember that they are same model and same software version
config webfilter urlfilter
edit 1
set name "default"
config entries
edit 1
set url "*web1.co.uk"
set type wildcard
set action block
next
end
config firewall policy
edit 1
set name "test"
set uuid xxxxx
set srcintf "internal"
set dstintf "wan1"
set srcaddr "1"
set dstaddr "all"
set action accept
set schedule "always"
set service "DNS" "Hotmail SMTP" "IMAP" "IMAPS" "NTP" "POP3" "SMTP" "SMTPS" "TRACEROUTE" "HTTP" "HTTPS" "PING" "WZ"
set utm-status enable
set logtraffic disable
set fsso disable
set webfilter-profile "default"
set ssl-ssh-profile "certificate-inspection"
set nat enable
next
Any thoughts anyone?
Hi @londonnet,
So web1.co.uk is not getting blocked? Can you make sure traffic is matching policy 1? Have you checked web filter logs?
Regards,
web1.co.uk is not getting blocked and I have confirmed that the traffic matches to policy 1 by disabling it and finding that I can not get to any websites.
There are also not that many policys that provide Internet access.
How do you view the filter logs?
Hello londonnet,
Based on the firewall rule "test", you do not have logging enabled you can enable this in the policy at the very bottom.
You could filter the forward traffic based on source and destination to see traffic going from your device to this address is being blocked/denied https://community.fortinet.com/t5/FortiGate/Technical-Tip-Log-all-user-traffic-URLs-using-web-filter...
Thanks for the tip. I'll see what I can get from the logs but I think it could be some sort of global command that has rendered web filtering inactive as the same config works on another 90D with the same software level.
The differences are that on the 90D that works, I only have the default web profile available but on the 90D that doesn't work I can create multiple profiles
Could it be related to an expired subscription or license?
Another difference I see is when I go into the feature visibility tab on the 90D that does have working web filtering there are more features available to enable.
I don't understand how there can be so many differences between two 90D's with the same software version. Are there any global commands that I can compare and bring them to the same functional state?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1705 | |
1093 | |
752 | |
446 | |
230 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.