Local category and remote category override can now be controlled at the profile level.

In proxy mode, webfilter profile, ssl-exempt, and proxy-address have similar behavior in handling local and remote categories. For example, in local category:

• In 6.0.x, 6.2.x, 6.4.0, and 6.4.1, once a host is configured in the local rating as category 140, it will be always rated as 140 at the global or VDOM level. There is no profile-level option to control it.
• In 6.4.2, the host will be rated as the configured local rating only when that category is explicitly configured in a web filter profile. This override can be applied to webfilter profile, ssl-exempt, and proxy-address.

The following is an example configuration for a web filter profile:

config webfilter profile
  edit webf-use-local-rating
    config ftgd-wf
      config filters
        edit 1
          set category 140
          set action monitor
        next
      end
    end
  next
end

The rating in webfilter profile, ssl-exempt, and proxy-address are independent from each other.

In the GUI, an Allow action of a local/remote category when editing a web filter profile is effectively a shortcut to disable the local/remote category overrides.

For flow mode, only webfilter profile is involved, and it has different behavior as the change is in the IPS engine:

• In 6.2.5 and 6.4.2, the local/remote rating only takes effect when the category is enabled in webfilter profile.
• In 6.2.1-6.2.4 and 6.4.0-6.4.1, currently the local/remote rating is still at the global or VDOM level. After the next IPS engine public release, the behavior will be changed to be the same as 6.2.5/6.4.2.

There is no change in ssl-exempt for FortiGuard with flow mode and the NGFW URL category.