FortiGuard Expired: Why Web Filtering Locks Users Out
When the FortiGuard web filter subscription lapses, the FortiGate does not turn into a brick. Firewall and VPN keep working. Category ratings stop, because those are live lookups. By default, web traffic is dropped. If “allow website requests when a rating error occurs” is on, traffic passes with no category filter. Renew the subscription, disable UTM scanning, or knowingly accept unfiltered web.
Megatron Technology Pte Ltd, Singapore. We size and supply Fortinet.
Related pages: Fortinet · FortiGate vs Meraki MX for Singapore offices · FortiGate conserve mode on small units · Knowledge base
What still works, and what stops?
| Function | After FortiGuard web filter expires |
|---|---|
| Firewall rules | Still work |
| VPN | Still works |
| Category web and DNS filtering | Stops. Ratings are live FortiGuard lookups |
| Web traffic, default | Dropped |
| Web traffic if “allow on rating error” is enabled | Passes, unfiltered |
| Static URL filters already in the profile | Still apply |
| Hardware | Stays up. This is not an RMA |
That default drop is why users report that the internet is down. The line is up. The firewall is up. Category lookup failed, and the policy treats a failed rating as deny.
Why do the dates not match?
FortiCare (hardware support / RMA) and FortiGuard (signatures and categories) are different lines. A box can still be under hardware support and have an expired web filter. Ensure all required services are renewed on time.
What to expect when web filter has expired?
| Choice | What staff get | What security gets |
|---|---|---|
| Renew FortiGuard web filter | Categories return after the licence lands | The control you bought |
| Leave the default | Web stays blocked | No browsing, which is safe and loud |
| Turn on “allow when a rating error occurs” | Browsing returns the same day | No category filter until you renew. Static URL blocks still apply |
| Remove the web-filter profile from the policy | Browsing returns | You have switched the control off. Say so in the change record |
Disabling security measures as a workaround is temporary, not a permanent fix.
FAQ
Is this conserve mode?
No. Conserve mode is low RAM. An expired web filter is a subscription.
Will antivirus and IPS die the same day?
Only if those FortiGuard entitlements expired too. This article is the web-filter rating failure Fortinet documents as a default drop.
Send the model and a screenshot of the FortiGuard licence page (web filter date, not only FortiCare). Megatron Technology will say renew, allow-on-error as a bridge, or which other entitlement actually expired.
Request a renewal check: www.megatron.com.sg/fortinet · Contact
Megatron Technology Pte Ltd (est. 1990, UEN 199002644W) is a Singapore Cisco Networking Partner and Managed Services Provider, and a Fortinet reseller. We design, size, licence, procure, deploy and support Cisco Meraki, FortiGate, and Cisco Catalyst & Data Centre from 2 Kallang Avenue #08-17 CT Hub, Singapore 339407.