URL Filtering / Web Filter
How FortiGate web filtering fits into firewall policy, FortiGuard categories, local URL filters, inspection mode and troubleshooting.
Overview
FortiGate web filtering can control web access using FortiGuard categories, locally defined URL filters, rating overrides and related web-security features. In most deployments, a web filter profile is attached to a firewall policy that permits the traffic.
Inspection modes
Behavior depends on the FortiOS release and whether the policy uses flow-based or proxy-based inspection. HTTPS visibility can also depend on the SSL/SSH inspection profile. If FortiGate cannot inspect the relevant hostname or URL information, filtering behavior may differ from what you expect.
Relationship to firewall policy
A web filter profile does not replace a firewall policy. The firewall policy determines whether traffic is allowed and which security profiles are applied. When troubleshooting URL filtering, confirm the correct policy is matched first, then verify the web-filter profile and SSL inspection assigned to that policy.
CLI quick reference
show webfilter profile show webfilter urlfilter show firewall policy # Useful session/policy checks diagnose debug flow filter clear diagnose debug flow filter addr <client-ip> diagnose debug flow show function-name enable diagnose debug enable diagnose debug flow trace start 20 # Stop debug diagnose debug disable diagnose debug reset
Exact commands and profile structure can vary by FortiOS release. Use the current administration guide for the deployed version.
Troubleshooting checklist
| Check | Why |
|---|---|
| Correct firewall policy | Verify the session is matching the policy that actually has the expected security profiles. |
| Web filter profile | Confirm the correct profile is attached and enabled. |
| SSL inspection | HTTPS filtering visibility depends heavily on the inspection configuration. |
| FortiGuard rating | Check whether the URL/category rating is what you expect. |
| Local URL filter | Verify wildcard/simple/regex behavior and ordering. |
| Logs | Use web-filter and traffic logs to see category, action and matched policy. |
| DNS / certificate / browser behavior | Client-side resolution, QUIC/HTTP3, certificate inspection and browser caching can affect symptoms. |