Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
londonnet
New Contributor III

web filtering not working on 90D

I have two fortigate 90d's both running v6.0.17 build0528 (GA)

I have configured the default web filters identically and applied to the policies 

However, on one 90D it will block all the wildcard url's I enter but the other only does work 

I also see on the 90D that is not working correctly that I have and can configure more web filter profiles while on the 90D that works, I can only edit the default web filter profile.

 

I have tried to compare configs between the two 90D's but I can not see anything related that is different.

None of the units have FortiGuard licenses or the option selected

 

Are there any global commands I should look at?

Any ideas or areas to look at would be appreciated

8 REPLIES 8
lgupta
Staff
Staff

Hello londonnet, Good day!

Thank you for reaching us.

 

Can you please share the web-filter and firewall policy CLI output from two FortiGates here? Please mention which one of them is working and also don't forget to hide the sensitive information.


Please be advised that 6.0.x is Out of support. Could be a bug that cannot be fixed on that branch.

 

thank you!

 

 

Best regards,

-lgupta



If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.
londonnet
New Contributor III

This is the config on the unit that works

config webfilter urlfilter
edit 1
set name "default"
config entries
edit 1
set url "*web1.co.uk"
set type wildcard
set action block
next
edit 2
set url "*web2.co.uk"
set type wildcard
set action block
next
edit 3
set url "*web3.com"
set type wildcard
set action block
next
edit 4
set url "*web4.co.uk"
set type wildcard
set action block

edit 8
set name "test1"
set uuid xxxxx
set srcintf "wifi"
set dstintf "wan1"
set srcaddr "1"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set utm-status enable
set logtraffic disable
set fixedport enable
set fsso disable
set av-profile "default"
set webfilter-profile "default"
set ssl-ssh-profile "certificate-inspection"
set nat enable

 

And this is the config on the unit that doesn't work but please remember that they are same model and same software version

 

config webfilter urlfilter
edit 1
set name "default"
config entries
edit 1
set url "*web1.co.uk"
set type wildcard
set action block
next
end

 

config firewall policy
edit 1
set name "test"
set uuid xxxxx
set srcintf "internal"
set dstintf "wan1"
set srcaddr "1"
set dstaddr "all"
set action accept
set schedule "always"
set service "DNS" "Hotmail SMTP" "IMAP" "IMAPS" "NTP" "POP3" "SMTP" "SMTPS" "TRACEROUTE" "HTTP" "HTTPS" "PING" "WZ"
set utm-status enable
set logtraffic disable
set fsso disable
set webfilter-profile "default"
set ssl-ssh-profile "certificate-inspection"
set nat enable
next

londonnet
New Contributor III

Any thoughts anyone?

hbac

Hi @londonnet,

 

So web1.co.uk is not getting blocked? Can you make sure traffic is matching policy 1? Have you checked web filter logs? 

 

Regards, 

londonnet
New Contributor III

web1.co.uk is not getting blocked and I have confirmed that the traffic matches to policy 1 by disabling it and finding that I can not get to any websites.

 

There are also not that many policys that provide Internet access.

 

How do you view the filter logs?

AnthonyH
Staff
Staff

Hello londonnet,

 

Based on the firewall rule "test", you do not have logging enabled you can enable this in the policy at the very bottom.

 

You could filter the forward traffic based on source and destination to see traffic going from your device to this address is being blocked/denied https://community.fortinet.com/t5/FortiGate/Technical-Tip-Log-all-user-traffic-URLs-using-web-filter...

Technical Support Engineer,
Anthony.
londonnet
New Contributor III

Thanks for the tip. I'll see what I can get from the logs but I think it could be some sort of global command that has rendered web filtering inactive as the same config works on another 90D with the same software level.

 

The differences are that on the 90D that works, I only have the default web profile available but on the 90D that doesn't work I can create multiple profiles

 

Could it be related to an expired subscription or license?

londonnet
New Contributor III

Another difference I see is when I go into the feature visibility tab on the 90D that does have working web filtering there are more features available to enable.

I don't understand how there can be so many differences between two 90D's with the same software version. Are there any global commands that I can compare and bring them to the same functional state?

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors