Web Filtering for a Marketing Agency with Contractors and Executives
A 1,200-person marketing agency uses FortiSASE secure internet access with Entra ID SSO. Employees are in one group; 300 contractors are in a separate Entra group; executives are in a third. The current web filter profile is identical for everyone. Contractors must be limited to business categories, employees need broad access, and executives require an SSL-inspection exemption for personal banking. Since rollout, contractors reach a gambling site by direct IP, some users enable DNS-over-HTTPS to Cloudflare and bypass category blocks, and an executive's bank portal fails under deep SSL inspection. Guest Wi-Fi is outside FortiSASE and unfiltered. The agency has 14 sites and a single FortiSASE tenant. It wants one policy set, no per-user exceptions except the executive group, and logs that prove contractor restrictions.
1. How would you structure web filter policies and prove contractor restrictions?
Read the worked answer
Use identity-based policies in top-down order: executives first for the narrow banking SSL exemption, contractors second for the restricted business-category profile, employees third for the broad profile. Avoid per-user exceptions; group membership from Entra ID drives the policy. For the direct-IP gambling access, add explicit URL and IP blocks and IP reputation, because category lookup may not classify a raw IP. Apply the contractor policy to the contractor group only and log all actions. To prove restrictions, generate a report filtered by user group and blocked category, and run a test contractor login against the gambling IP. Confirm logs show the policy name and block reason, not just a generic deny.
2. How do you stop DNS-over-HTTPS and DNS-over-TLS bypass?
Read the worked answer
Web filtering cannot categorize encrypted DoH requests, so you must control the channel. Block known DoH and DoT applications and resolvers with application control and static URL or IP blocks, and apply DNS filtering to all users. On managed endpoints, enforce the corporate DNS resolver through FortiClient and block local DoH settings. Enable SSL inspection for categories where DoH is likely, but do not rely on it alone. Monitor DNS and application-control logs for Cloudflare and Google DoH endpoints and for direct-to-IP TLS. If users still bypass, use endpoint compliance to require the FortiClient DNS policy.
3. Why does the executive bank portal fail, and how do you fix it without broad exemptions?
Read the worked answer
The bank likely uses certificate pinning or a private CA, so deep SSL inspection replaces the certificate and the browser rejects it. Confirm by checking the certificate error and FortiSASE SSL logs. Create a narrow SSL exemption for the executive group and the bank's domains only; do not exempt all finance or all executives. Compensate with DNS filtering, IPS, and logging, and document the residual risk. Ensure the FortiSASE CA is installed on managed endpoints for everything else. If the bank is personal use, consider policy restrictions rather than weakening inspection for the whole group.