whitelist specific user IP address from block all users web filtering in Fortigate 100F

[khemlina]

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

[VinayHM · Accepted solution]

Hi @khemlina 

You can create one more policy on top of this to allow those users and not block social media ( create another custom web filter ) In the UTM profile.

Regards,

[pjawalekar · Accepted solution]

Hi khemlina,

As you have configured the firewall policy with web filter profile to block the Social Media for vlan subnet, you can create one more policy for the specific ip's which you want to allow the social media access. You need to keep this policy above the existent one as the policies will be checked from top to bottom and with first match it will stop the policy lookup.

Below is the KB article which will be useful to understand how you can create the welbfilter profile to allow or block the specific url's

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-a-static-URL-filter-feature-to-allow...   

Regard's,
Pratik

[VinayHM · Accepted solution]

Hi @khemlina 

You can create one more policy on top of this to allow those users and not block social media ( create another custom web filter ) In the UTM profile.

Regards,

[khemlina]

Hi @VinayHM 
I'm not sure understand well so
1-create another web filter (ex: No_Block_Social_Media)

2-create source address (IP address that we allow to access social media)
3-create policy

pls help to add more details for this.
thanks

[VinayHM]

Hi @khemlina 

Yes, Create a new web filter and make sure social media is allowed.

create another policy (on top where vlan 4 users are blocked by social media), In this policy call the newly created web filter.

And finally, Call the user group or address object in the source address.

Regards,

[Dongfang_Li_FTNT]

The newly created policy has specify IP addresses instead of all in the destination address, the web filter can be disable because this policy only allows connection to the specified IP addresses.  

Regards,

Dongfang  

[pjawalekar · Accepted solution]

Hi khemlina,

As you have configured the firewall policy with web filter profile to block the Social Media for vlan subnet, you can create one more policy for the specific ip's which you want to allow the social media access. You need to keep this policy above the existent one as the policies will be checked from top to bottom and with first match it will stop the policy lookup.

Below is the KB article which will be useful to understand how you can create the welbfilter profile to allow or block the specific url's

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-a-static-URL-filter-feature-to-allow...   

Regard's,
Pratik

[Rajneesh · Accepted solution]

You can create a new policy and in the source allow the  few IP address of this Vlan4 to access Social Media and keep that policy in top or above the Block_Social_Media, 
As mentioned by @pjawalekar the policies will be checked from top to bottom and with first match it will stop the policy lookup.

[khemlina]

Hello all
Thanks for your guideline. Now It's working.