Fortinet black logo

Administration Guide

Advanced filters 1

Advanced filters 1

This topic gives examples of the following advanced filter features:

Block malicious URLs discovered by FortiSandbox

To use this feature, you must be registered to a FortiSandbox and be connected to it.

This feature blocks malicious URLs that FortiSandbox finds.

For information on configuring FortiSandbox, see Using FortiSandbox Cloud with antivirus.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and click Create New, or edit an existing profile.
  2. Go the Static URL Filter section and enable Block malicious URLs discovered by FortiSandbox.

  3. Click OK.

To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        config web
            set blacklist enable
        end
    next
end

Allow websites when a rating error occurs

If you don't have a FortiGuard license but you have enabled services that need a FortiGuard license, such as FortiGuard filter, then you'll get a rating error message.

Use this setting to allow access to websites that return a rating error from the FortiGuard Web Filter service.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and go to the Rating Options section.
  2. Enable Allow websites when a rating error occurs.
  3. Click OK.

To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        config ftgd-wf
            set options error-allow
        end
    next
end

Rate URLs by domain and IP address

If you enable this feature, in addition to only sending domain information to FortiGuard for rating, FortiGate always sends both the URL domain name and the TCP/IP packet's IP address (except for private IP addresses) to FortiGuard for the rating.

FortiGuard server might return a different category of IP address and URL domain. If they are different, FortiGate uses the rating weight of the IP address or domain name to determine the rating result and decision. This rating weight is hard-coded in FortiGate.

For example, if we use a spoof IP of Google as www.irs.gov, FortiGate will send both the IP address and domain name to FortiGuard to get the rating. In this example, we get two different ratings, one is search engine and portals which belongs to the IP of Google, another is government and legal organizations which belongs to www.irs.gov. As the search engine and portals has a higher weight than government and legal organizations, this traffic will be rated as search engine and portals and not rated as government and legal organizations.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and go to the Rating Options section.
  2. Enable Rate URLs by domain and IP address.
  3. Click OK.
To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        config ftgd-wf
            set options rate-server-ip
        end
    next
end

Block invalid URLs

Use this feature to block websites when their SSL certificate CN field does not contain a valid domain name.

For example, this option blocks URLs which contains spaces. If there is a space in the URL, it must be written as: http://www.example.com/space%20here.html.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and go to the Static URL Filter section.
  2. Enable Block invalid URLs .

  3. Click OK.

To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        set options block-invalid-url
    next
end

Advanced filters 1

This topic gives examples of the following advanced filter features:

Block malicious URLs discovered by FortiSandbox

To use this feature, you must be registered to a FortiSandbox and be connected to it.

This feature blocks malicious URLs that FortiSandbox finds.

For information on configuring FortiSandbox, see Using FortiSandbox Cloud with antivirus.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and click Create New, or edit an existing profile.
  2. Go the Static URL Filter section and enable Block malicious URLs discovered by FortiSandbox.

  3. Click OK.

To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        config web
            set blacklist enable
        end
    next
end

Allow websites when a rating error occurs

If you don't have a FortiGuard license but you have enabled services that need a FortiGuard license, such as FortiGuard filter, then you'll get a rating error message.

Use this setting to allow access to websites that return a rating error from the FortiGuard Web Filter service.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and go to the Rating Options section.
  2. Enable Allow websites when a rating error occurs.
  3. Click OK.

To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        config ftgd-wf
            set options error-allow
        end
    next
end

Rate URLs by domain and IP address

If you enable this feature, in addition to only sending domain information to FortiGuard for rating, FortiGate always sends both the URL domain name and the TCP/IP packet's IP address (except for private IP addresses) to FortiGuard for the rating.

FortiGuard server might return a different category of IP address and URL domain. If they are different, FortiGate uses the rating weight of the IP address or domain name to determine the rating result and decision. This rating weight is hard-coded in FortiGate.

For example, if we use a spoof IP of Google as www.irs.gov, FortiGate will send both the IP address and domain name to FortiGuard to get the rating. In this example, we get two different ratings, one is search engine and portals which belongs to the IP of Google, another is government and legal organizations which belongs to www.irs.gov. As the search engine and portals has a higher weight than government and legal organizations, this traffic will be rated as search engine and portals and not rated as government and legal organizations.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and go to the Rating Options section.
  2. Enable Rate URLs by domain and IP address.
  3. Click OK.
To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        config ftgd-wf
            set options rate-server-ip
        end
    next
end

Block invalid URLs

Use this feature to block websites when their SSL certificate CN field does not contain a valid domain name.

For example, this option blocks URLs which contains spaces. If there is a space in the URL, it must be written as: http://www.example.com/space%20here.html.

To enable this feature in the GUI:
  1. Go to Security Profiles > Web Filter and go to the Static URL Filter section.
  2. Enable Block invalid URLs .

  3. Click OK.

To enable this feature in the CLI:
config webfilter profile
    edit "webfilter"
        set options block-invalid-url
    next
end