web filtering not working on 90D

[londonnet]

I have two fortigate 90d's both running v6.0.17 build0528 (GA)

I have configured the default web filters identically and applied to the policies 

However, on one 90D it will block all the wildcard url's I enter but the other only does work 

I also see on the 90D that is not working correctly that I have and can configure more web filter profiles while on the 90D that works, I can only edit the default web filter profile.

I have tried to compare configs between the two 90D's but I can not see anything related that is different.

None of the units have FortiGuard licenses or the option selected

Are there any global commands I should look at?

Any ideas or areas to look at would be appreciated

[lgupta]

Hello londonnet, Good day!

Thank you for reaching us.

Can you please share the web-filter and firewall policy CLI output from two FortiGates here? Please mention which one of them is working and also don't forget to hide the sensitive information.

Please be advised that 6.0.x is Out of support. Could be a bug that cannot be fixed on that branch.

thank you!

[londonnet]

This is the config on the unit that works

config webfilter urlfilter
edit 1
set name "default"
config entries
edit 1
set url "*web1.co.uk"
set type wildcard
set action block
next
edit 2
set url "*web2.co.uk"
set type wildcard
set action block
next
edit 3
set url "*web3.com"
set type wildcard
set action block
next
edit 4
set url "*web4.co.uk"
set type wildcard
set action block

edit 8
set name "test1"
set uuid xxxxx
set srcintf "wifi"
set dstintf "wan1"
set srcaddr "1"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set utm-status enable
set logtraffic disable
set fixedport enable
set fsso disable
set av-profile "default"
set webfilter-profile "default"
set ssl-ssh-profile "certificate-inspection"
set nat enable

And this is the config on the unit that doesn't work but please remember that they are same model and same software version

config webfilter urlfilter
edit 1
set name "default"
config entries
edit 1
set url "*web1.co.uk"
set type wildcard
set action block
next
end

config firewall policy
edit 1
set name "test"
set uuid xxxxx
set srcintf "internal"
set dstintf "wan1"
set srcaddr "1"
set dstaddr "all"
set action accept
set schedule "always"
set service "DNS" "Hotmail SMTP" "IMAP" "IMAPS" "NTP" "POP3" "SMTP" "SMTPS" "TRACEROUTE" "HTTP" "HTTPS" "PING" "WZ"
set utm-status enable
set logtraffic disable
set fsso disable
set webfilter-profile "default"
set ssl-ssh-profile "certificate-inspection"
set nat enable
next

[londonnet]

Any thoughts anyone?

[hbac]

Hi @londonnet,

So web1.co.uk is not getting blocked? Can you make sure traffic is matching policy 1? Have you checked web filter logs? 

Regards, 

[londonnet]

web1.co.uk is not getting blocked and I have confirmed that the traffic matches to policy 1 by disabling it and finding that I can not get to any websites.

There are also not that many policys that provide Internet access.

How do you view the filter logs?

[AnthonyH]

Hello londonnet,

Based on the firewall rule "test", you do not have logging enabled you can enable this in the policy at the very bottom.

You could filter the forward traffic based on source and destination to see traffic going from your device to this address is being blocked/denied https://community.fortinet.com/t5/FortiGate/Technical-Tip-Log-all-user-traffic-URLs-using-web-filter...

[londonnet]

Thanks for the tip. I'll see what I can get from the logs but I think it could be some sort of global command that has rendered web filtering inactive as the same config works on another 90D with the same software level.

The differences are that on the 90D that works, I only have the default web profile available but on the 90D that doesn't work I can create multiple profiles

Could it be related to an expired subscription or license?

[londonnet]

Another difference I see is when I go into the feature visibility tab on the 90D that does have working web filtering there are more features available to enable.

I don't understand how there can be so many differences between two 90D's with the same software version. Are there any global commands that I can compare and bring them to the same functional state?