1

We set up Webfilters in a Fortigate. We see certain packets dropped due to the violation of a web filter policy. The strange thing is it seems to me there is no way of seeing in the logs what the reason is why that packet is dropped. I would expect to see: connection is dropped because the connection is considered to connect to a website in the cataegory of “known malicious”. Am I overlooking this or is a Fortigate not showing this information in the local logs?

4 Spice ups
2

Do you have logging enabled for the webfilter? I’m a little rusty on my FGT, but my recollection is that you would need to enable the logging for that function. My guess is that it is likely disabled, the CPU load involved is probably significant.

1 Spice up
3

I believe you have to enable logging for the web filter.

Check out Link

4

Thanks for answering. But that is not really what we are looking for. The problem is we see a deny based on a blocked web cataegory but there are connection that we believe should not be blocked and it seems to me there is no way to have an insight into why Fortigate thinks it needs to be blocked. I find that surprising and even shocking.

Do other people with fortigate see the reason why Fortigate thinks it should be blocked in the packet log? I do see what the rule was that caused the blocking but I expect to see extra info as well somewhere.