Fortinet black logo

Administration Guide

Web Filter restricted administrator

Web Filter restricted administrator

Web filtering restricts or controls user access to web resources.

To create a profile:
  1. Log in as a Restricted Administrator.
  2. In the tree menu, select Web Filter, and then select a profile category.
  3. In the toolbar, click Create New.
  4. Configure the profile settings, and click OK.
Tooltip

To clone an existing profile, right-click the profile in the content pane, and select Clone.

To edit a profile:
  1. Log in as a Restricted Administrator.
  2. In the tree menu, select Web Filter, and then select a profile category.
  3. In the content pane select a profile and take one of the following actions:
    • In the toolbar, click Edit.
    • Right-click the profile, and select Edit.
  4. Edit the settings, and click OK.

Name

The profile name.

Comment

Optionally, enter a description of the profile.

Advanced Options

Configure advanced options, including:

  • https-replacemsg: enable/disable
  • replacemsg-group: select a group from the list
  • web-filter-activex-log: enable/disable
  • web-filter-command-block-log: enable/disable
  • web-filter-cookie-removal-log: enable/disable
  • web-filter-js-log: enable/disable
  • web-filter-jscript-log: enable/disable
  • web-filter-referer-log: enable/disable
  • web-filter-unknown-log: enable/disable
  • web-filter-vbs-log: enable/disable
  • wisp: enable/disable
  • wisp-algorithm: auto-learning, primary-secondary, or round-robin

Inspection Mode

Select Proxy or Flow Based.

Log all URLs

Select to log all URLs.

FortiGuard Categories

Select FortiGuard categories.

Right-click on a category to change the action: Allow, Block, Warning, Monitor, Authenticate, or, if available, Disable.

Use the filter drop-down menu to filter the categories shown in the table based on the action.

Allow Users to override blocked categories

Select to allow users to override blocked categories.

This option is only available if Inspection Mode is Proxy.

Override Permit

Select the override permits: bannedword-override, contenttype-check-override, fortiguard-wf-override, and urlfilter-override.

Groups that can override

Select groups that can override blocked categories.

Profile can switch to

Select profiles that the user can switch to.

Switch applies to

Select what the switch applies to: ask, browser, ip, user, or user-group.

Switch Duration

Select the switch duration, either ask or constant.

Duration

Enter the duration of the switch.

This option is only available if Switch Duration is constant.

Enforce 'Safe Search' on Google, Yahoo!, Bing, Yandex

Select to enforce Safe Search.

This option is only available if Inspection Mode is Proxy.

Log all search keywords

Select to log all search keywords.

This option is only available if Inspection Mode is Proxy.

Block Invalid URLs

Select to block invalid URLs.

This option is only available if Inspection Mode is Proxy.

URL Filter

Select to enable URL filters.

Select URL filters from the dropdown list, and/or create and manage filters in the table.

Block malicious URLs discovered by FortiSandbox

Select to block URLs that FortiSandbox deems malicious.

Web Content Filter

Select to apply web content filters. Click Add to add filters to the table. Edit and delete filters as required.

Allow Websites When a Rating Error Occurs

Select to allow access to websites if a rating error occurs.

Rate URLs by Domain and IP Address

Select to rate URLs by both their domain and IP address.

Block HTTP Redirects by Rating

Select to block HTTP redirects based on the site's rating.

This option is only available if Inspection Mode is Proxy.

Rate Images by URL (Blocked images will be replaced with blanks)

Select to rate images based on the URL.

This option is only available if Inspection Mode is Proxy.

Restrict Google account usage to specific domains

Select to restrict Google account usage to specific domains. Click Add to add the domains to the table.

This option is only available if Inspection Mode is Proxy.

Provide Details for Blocked HTTP 4xx and 5xx Errors

Select to receive details about blocked HTTP errors.

This option is only available if Inspection Mode is Proxy.

HTTP POST Action: Block

Select to set the HTTP POST action to block.

This option is only available if Inspection Mode is Proxy.

Remove Java Applet Filter

Select to remove the Java applet filter.

This option is only available if Inspection Mode is Proxy.

Remove ActiveX Filter

Select to remove the ActiveX filter.

This option is only available if Inspection Mode is Proxy.

Remove Cookie Filter

Select to remove the cookie filter.

This option is only available if Inspection Mode is Proxy.

To view where a profile is being used:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Profiles.
  3. In the content pane, select a profile from the list, and click Where Used in the More dropdown menu.
    The dialog window displays the ADOM and policy package/block where the package is currently being used.

Web Filter restricted administrator

Web filtering restricts or controls user access to web resources.

To create a profile:
  1. Log in as a Restricted Administrator.
  2. In the tree menu, select Web Filter, and then select a profile category.
  3. In the toolbar, click Create New.
  4. Configure the profile settings, and click OK.
Tooltip

To clone an existing profile, right-click the profile in the content pane, and select Clone.

To edit a profile:
  1. Log in as a Restricted Administrator.
  2. In the tree menu, select Web Filter, and then select a profile category.
  3. In the content pane select a profile and take one of the following actions:
    • In the toolbar, click Edit.
    • Right-click the profile, and select Edit.
  4. Edit the settings, and click OK.

Name

The profile name.

Comment

Optionally, enter a description of the profile.

Advanced Options

Configure advanced options, including:

  • https-replacemsg: enable/disable
  • replacemsg-group: select a group from the list
  • web-filter-activex-log: enable/disable
  • web-filter-command-block-log: enable/disable
  • web-filter-cookie-removal-log: enable/disable
  • web-filter-js-log: enable/disable
  • web-filter-jscript-log: enable/disable
  • web-filter-referer-log: enable/disable
  • web-filter-unknown-log: enable/disable
  • web-filter-vbs-log: enable/disable
  • wisp: enable/disable
  • wisp-algorithm: auto-learning, primary-secondary, or round-robin

Inspection Mode

Select Proxy or Flow Based.

Log all URLs

Select to log all URLs.

FortiGuard Categories

Select FortiGuard categories.

Right-click on a category to change the action: Allow, Block, Warning, Monitor, Authenticate, or, if available, Disable.

Use the filter drop-down menu to filter the categories shown in the table based on the action.

Allow Users to override blocked categories

Select to allow users to override blocked categories.

This option is only available if Inspection Mode is Proxy.

Override Permit

Select the override permits: bannedword-override, contenttype-check-override, fortiguard-wf-override, and urlfilter-override.

Groups that can override

Select groups that can override blocked categories.

Profile can switch to

Select profiles that the user can switch to.

Switch applies to

Select what the switch applies to: ask, browser, ip, user, or user-group.

Switch Duration

Select the switch duration, either ask or constant.

Duration

Enter the duration of the switch.

This option is only available if Switch Duration is constant.

Enforce 'Safe Search' on Google, Yahoo!, Bing, Yandex

Select to enforce Safe Search.

This option is only available if Inspection Mode is Proxy.

Log all search keywords

Select to log all search keywords.

This option is only available if Inspection Mode is Proxy.

Block Invalid URLs

Select to block invalid URLs.

This option is only available if Inspection Mode is Proxy.

URL Filter

Select to enable URL filters.

Select URL filters from the dropdown list, and/or create and manage filters in the table.

Block malicious URLs discovered by FortiSandbox

Select to block URLs that FortiSandbox deems malicious.

Web Content Filter

Select to apply web content filters. Click Add to add filters to the table. Edit and delete filters as required.

Allow Websites When a Rating Error Occurs

Select to allow access to websites if a rating error occurs.

Rate URLs by Domain and IP Address

Select to rate URLs by both their domain and IP address.

Block HTTP Redirects by Rating

Select to block HTTP redirects based on the site's rating.

This option is only available if Inspection Mode is Proxy.

Rate Images by URL (Blocked images will be replaced with blanks)

Select to rate images based on the URL.

This option is only available if Inspection Mode is Proxy.

Restrict Google account usage to specific domains

Select to restrict Google account usage to specific domains. Click Add to add the domains to the table.

This option is only available if Inspection Mode is Proxy.

Provide Details for Blocked HTTP 4xx and 5xx Errors

Select to receive details about blocked HTTP errors.

This option is only available if Inspection Mode is Proxy.

HTTP POST Action: Block

Select to set the HTTP POST action to block.

This option is only available if Inspection Mode is Proxy.

Remove Java Applet Filter

Select to remove the Java applet filter.

This option is only available if Inspection Mode is Proxy.

Remove ActiveX Filter

Select to remove the ActiveX filter.

This option is only available if Inspection Mode is Proxy.

Remove Cookie Filter

Select to remove the cookie filter.

This option is only available if Inspection Mode is Proxy.

To view where a profile is being used:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Profiles.
  3. In the content pane, select a profile from the list, and click Where Used in the More dropdown menu.
    The dialog window displays the ADOM and policy package/block where the package is currently being used.