Pornhub listed as Pornography But Accessible

[theArties]

Hi All, 

I'm trying to make sense of this 200D unit whereby the fortigate categories were used to blocked all pornography. 

However when it was tested, www.pornhub.com is accessible. For comparison sake, www.playboy.com is blocked. 

I'm open to correction here, but by design the unit will contact the fortiguard services before it allows the access right? if so, it should be getting the updated ratings right? Is there a way to refresh the ratings if it's cached locally.

[ede_pfau]

I think the problem is not directly related to rating.

Pornhub and youporn.com have recently switched to HTTPS, the latter today. That may be the reason why the URL on the blacklist doesn't trigger. I don't think you would need Deep Inspection, though - if anyone could comment on this I'd be glad: if WF working regardless of the protocol, judging just by the URL?

[mike_dp]

Pornhub now uses https. Maybe you don't have SSL inspection activated ?

[hmtay_FTNT]

Hello,

Did you enable certificate-inspection under "SSL Inspection" or "set ssl-ssh-profile <>"? ede_pfau and mike_dp are right, if a site uses HTTPS, you have to use at least the default "certificate-inspection" profile to make the FortiGate scan the HTTPS SNI - the Client Hello hostname or the SSL Certificate common name.

HoMing

[theArties]

Dear All, 

thanks for your time in replying. 

The URL assessible is http://www.pornhub.com. Not HTTPS. 

And SSL Inspection has been turned on too. 

Hence could not make sense why it does not work. 

[Fullmoon]

upon checking accessing http://www.pornhub.com redirected to HTTPS.

[jim3cantos]

I had the same problem as @theArties until I changed back the inspection mode in the web filter profile to Proxy (tried flow mode before because fortiguard categories didn't seem to work at all). After the change "adult" pages with https protocol are been blocked correctly (provided that "certificate-inspection" is activated in the policy).