If you just created the override and tested it immediately, the browser or the FortiGate unit might be holding onto the old "state" of the connection.
FortiGate firewalls cache rating results to speed up performance. If you recently created an override, the device may still be using the old, cached category.
Toggle it , click Apply , then toggle it back On and click Apply again. Wait approximately 15 minutes for the changes to propagate. 2. Verify the URL and Category in CLI fortigate web rating override not working
If your FortiGate is in , creating a Web Rating Override in the root VDOM (or a management VDOM) does not automatically apply it to the traffic-processing VDOMs.
“Override isn’t broken. Rating is.” If you just created the override and tested
Creating the override only re-categorizes the site. You must still ensure the Web Filter Profile applied to your firewall policy is configured to allow or block that specific new category.
He cracked open a cold coffee from three hours ago and dug into the CLI. That’s when he saw it. A tiny, almost invisible line in the config webfilter profile : Toggle it , click Apply , then toggle
He fixed the DNS, forced a FortiGuard update via CLI ( execute update-now ), and watched the debug flow switch to:
Here is a troubleshooting guide structured to resolve the issue, ordered from the most common causes to the more complex ones.
Web Rating Overrides work by inspecting the URL. If the traffic is HTTPS (which most modern web traffic is), the FortiGate cannot see the URL inside the encrypted tunnel unless SSL Inspection is active.
Troubleshooting FortiGate Web Rating Override Not Working It is frustrating when a FortiGate web rating override fails to take effect, especially when you need to urgently allow or block a specific site. This issue typically occurs due to cached data, improper SSL inspection settings, or configuration mismatches between the override and the active web filter profile. Common Reasons Your Override Isn't Working