Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Changes in default behavior

Bug ID

Description

630433

Local category and remote category override can now be controlled at the profile level.

In proxy mode, webfilter profile, ssl-exempt, and proxy-address have similar behavior in handling local and remote categories. For example, in local category:

  • In 6.0.x, 6.2.x, 6.4.0, and 6.4.1, once a host is configured in the local rating as category 140, it will be always rated as 140 at the global or VDOM level. There is no profile-level option to control it.
  • In 6.4.2, the host will be rated as the configured local rating only when that category is explicitly configured in a web filter profile. This override can be applied to webfilter profile, ssl-exempt, and proxy-address.

The following is an example configuration for a web filter profile:

config webfilter profile
  edit webf-use-local-rating
    config ftgd-wf
      config filters
        edit 1
          set category 140
          set action monitor
        next
      end
    end
  next
end

The rating in webfilter profile, ssl-exempt, and proxy-address are independent from each other.

In the GUI, an Allow action of a local/remote category when editing a web filter profile is effectively a shortcut to disable the local/remote category overrides.

For flow mode, only webfilter profile is involved, and it has different behavior as the change is in the IPS engine:

  • In 6.2.5 and 6.4.2, the local/remote rating only takes effect when the category is enabled in webfilter profile.
  • In 6.2.1-6.2.4 and 6.4.0-6.4.1, currently the local/remote rating is still at the global or VDOM level. After the next IPS engine public release, the behavior will be changed to be the same as 6.2.5/6.4.2.

There is no change in ssl-exempt for FortiGuard with flow mode and the NGFW URL category.

Changes in default behavior

Bug ID

Description

630433

Local category and remote category override can now be controlled at the profile level.

In proxy mode, webfilter profile, ssl-exempt, and proxy-address have similar behavior in handling local and remote categories. For example, in local category:

  • In 6.0.x, 6.2.x, 6.4.0, and 6.4.1, once a host is configured in the local rating as category 140, it will be always rated as 140 at the global or VDOM level. There is no profile-level option to control it.
  • In 6.4.2, the host will be rated as the configured local rating only when that category is explicitly configured in a web filter profile. This override can be applied to webfilter profile, ssl-exempt, and proxy-address.

The following is an example configuration for a web filter profile:

config webfilter profile
  edit webf-use-local-rating
    config ftgd-wf
      config filters
        edit 1
          set category 140
          set action monitor
        next
      end
    end
  next
end

The rating in webfilter profile, ssl-exempt, and proxy-address are independent from each other.

In the GUI, an Allow action of a local/remote category when editing a web filter profile is effectively a shortcut to disable the local/remote category overrides.

For flow mode, only webfilter profile is involved, and it has different behavior as the change is in the IPS engine:

  • In 6.2.5 and 6.4.2, the local/remote rating only takes effect when the category is enabled in webfilter profile.
  • In 6.2.1-6.2.4 and 6.4.0-6.4.1, currently the local/remote rating is still at the global or VDOM level. After the next IPS engine public release, the behavior will be changed to be the same as 6.2.5/6.4.2.

There is no change in ssl-exempt for FortiGuard with flow mode and the NGFW URL category.