Sub-category actions

After configuring category override rules, an override category must be active in a web filter profile for it to take effect. Whether a category is active or not depends on the override method and action:

Override method	Active category actions	Inactive category actions
FortiGuard categories	Monitor, Block, Warning, or Authenticate	Allow
Local categories	Allow, Monitor, Block, Warning, or Authenticate	Disable*
Remote categories	Allow, Monitor, Block, Warning, or Authenticate	Disable*

*The Disable action is only available for local and remote categories by right clicking on the sub-category.

The Allow action in the GUI is different for FortiGuard categories compared to local and remote categories.

For local and remote categories, the Allow action in the GUI corresponds to the monitor action with logging disabled in the CLI:

config webfilter profile
    edit <profile>
        config ftgd-wf
            config filters
                edit 142
                    set category 142
                    set action monitor
                    set log disable
                next
            end
        end
    next
end

For FortiGuard categories, the Allow action in the GUI corresponds to no entry in the CLI:

The Internet Radio and TV sub-category has ID number 75.

config webfilter profile
    edit <profile>
        config ftgd-wf
            config filters
            end
        end
    next
end

This means that a FortiGuard category with the Allow action applied is effectively inactive, as there is no actual action specified in the CLI.

See Category override examples for sample configurations.