Web Filtering and Application Control
Web Filtering and Application Control covers FortiGuard category enforcement, application signatures, and the inspection requirements that make both work. Many questions hinge on why a block did not happen: TLS encryption, missing certificate inspection, or the wrong profile attachment.
Web filter rules
- FortiGuard categories are matched by rating lookup; local categories can override global ratings.
- Static URL filter entries can allow, block, exempt, or monitor; exempt bypasses further web filtering and often SSL inspection.
- Safe search enforcement and YouTube education settings are profile options, not separate policies.
- Web filter profiles apply only on policies that accept traffic; the profile must be attached to the correct policy.
- HTTPS filtering requires deep inspection for category and URL matching; otherwise only SNI and certificate CN may be visible. FortiGuard ratings can be cached locally, and DNS filtering is a separate control that blocks by domain before HTTP inspection.
Application control
- Signatures identify applications by protocol behavior, not only port; applications can be grouped by category, risk, and popularity.
- Application control profiles can allow, block, monitor, or apply traffic shaping per application.
- QUIC can bypass web filtering if not blocked; block QUIC or enforce deep inspection.
- Unknown applications can be handled by a catch-all rule, but overblocking breaks business apps.
Worked example
A policy blocks the Social Media web category, but users still access a social app over HTTPS. The web filter profile is attached and the category is blocked. The likely gap is TLS 1.3 without deep inspection: FortiGate sees only the SNI, and certificate pinning may break inspection. The correct fix is to block the application signature and consider blocking QUIC; adding the app to application control with action block is more reliable than category alone. Do not enable deep inspection blindly: it requires a CA certificate on clients and breaks pinned apps.
Traps
- Exempt entries bypass antivirus and IPS too, not just web filtering.
- Application control does not replace web filtering for URL categories.
- Rating lookups may be cached; a newly rated site may not be blocked immediately.
Key points
- Deep inspection is required for HTTPS category and URL matching beyond SNI.
- Exempt URL entries bypass more than web filtering, including UTM inspection.
- Application control identifies behavior, not just ports.
- Blocking QUIC improves visibility and control of web traffic.
- Web filter and application control profiles must be attached to accepting policies.