3.4 Web Filtering & Static URL Management

3.4 Web Filtering & Static URL Management

Web Filtering in FortiOS 7.6 provides robust web access control, threat mitigation, and acceptable use policy enforcement. By combining cloud-based FortiGuard Category Filtering with local Static URL Filtering, Web Content Filtering, and Browsing Quotas, FortiGate controls user web activity across HTTP and HTTPS protocols.

---

FortiGuard Web Category Filtering

FortiGuard maintains a massive cloud database categorizing hundreds of millions of domain names into over 90 categories organized under major classification groups:

• Security Risks: Malicious Websites, Phishing, Spam URLs, Command and Control Servers.
• Adult / Mature Content: Pornography, Gambling, Weapons, Nudity.
• Bandwidth Consuming: Peer-to-Peer File Sharing, Streaming Media, Internet Telephony.
• General Interest / Business: Personal Vehicles, Finance and Banking, Web-based Email, Social Networking.

Category Actions

Within a Web Filter profile, administrators assign one of five actions to each FortiGuard category:

1. allow: Permits access unconditionally and logs if logging is enabled.
2. block: Denies access and displays a customizable FortiGate Web Filter block page.
3. monitor: Permits access while silently logging the request event.
4. warning: Displays a warning page informing the user that the site violates policy. The user can click Continue to proceed.
5. authenticate: Prompts the user to authenticate against a FortiGate user group before granting access to the category.

---

Static URL Filtering & Match Types

Static URL Filtering allows administrators to define explicit allow, block, or exemption rules for specific domain names or URL paths regardless of their FortiGuard category.

Static URL Actions

• allow: Permits access to the matching URL.
• block: Denies access to the matching URL.
• monitor: Permits access and records a web filter log entry.
• exempt: Bypasses FortiGuard Category checks, Antivirus scanning, and Web Content Filtering for the matching URL. Used for trusted corporate partners or internal application domains.

---

Web Filter Evaluation Order Hierarchy

Understanding the exact sequence in which FortiOS evaluates web filter checks is crucial for exam success and troubleshooting policy conflicts:

1. Static URL Filter Lookup: Evaluated FIRST! If a match is found and set to exempt, FortiGate bypasses all remaining checks and permits access.
2. FortiGuard Category Check: Evaluated if no static URL rule overrides it.
3. Web Content Filter Check: Scans page body text for banned words.
4. Web Quota Enforcement: Checks daily browsing time and bandwidth limits.

CRITICAL RULE: Static URL Filters are evaluated BEFORE FortiGuard Category lookups. If a request matches a Static URL entry set to exempt, FortiGate immediately permits the request without sending a category lookup query to FortiGuard servers.

---

Web Content Filtering & Quotas

• Web Content Filtering: Inspects the text contained within HTML body pages for specific banned words or phrases using block patterns or regex. If a web page body exceeds the configured threshold of banned word hits, access is blocked.
• Web Quota Enforcement: Allows administrators to limit the total time (in minutes) or total traffic volume (in megabytes) users can spend accessing specified web categories per day. Once the quota is exhausted, subsequent requests to that category are blocked.
• SafeSearch Enforcement: Forcefully enables SafeSearch for major search engines (Google, Bing, Yahoo, YouTube Restricted Mode) by intercepting search requests or rewriting DNS queries.

---

Overview Comparison

---

CLI Configuration Examples

Configuring a Static URL Filter Table

config webfilter urlfilter
    edit 1
        set name "Corporate_URL_Rules"
        config entries
            edit 1
                set url "www.blocked-example.com"
                set type simple
                set action block
                set status enable
            next
            edit 2
                set url "*.trusted-partner.org"
                set type wildcard
                set action exempt
                set status enable
            next
            edit 3
                set url ".*\\.gambling-site\\.net/.*"
                set type regex
                set action block
                set status enable
            next
        end
    next
end

Configuring a Web Filter Profile with Categories and Quotas

config webfilter profile
    edit "Corporate_Web_Profile"
        set comment "Web filter profile with static URL table and category rules"
        config web
            set urlfilter-table 1
        end
        config ftgd-wf
            config filters
                edit 1
                    set category 26
                    set action block
                next
                edit 2
                    set category 61
                    set action monitor
                next
            end
            config quota
                edit 1
                    set category 15
                    set type time
                    set value 3600
                    set unit minute
                next
            end
        end
        set enforcement-driven enable
    next
end