Intermittent behavior (working sometimes, failing others) points to resource or connectivity fluctuations rather than static misconfigurations.
B. Check that FortiGate is not entering conserve mode:
Reason: When FortiGate enters Conserve Mode (due to high memory usage), it changes its inspection behavior to save resources. Depending on the av-failopen setting, it may either bypass inspection (allowing blocked sites) or drop traffic (blocking valid sites) temporarily until memory recovers. This flapping between states causes intermittent filtering issues.
D. Check that the communication between FortiGate and FortiGuard is stable:
Reason: The Web Filter engine relies on real-time queries to the FortiGuard Distribution Network (FDN) to categorize URLs that are not in the local cache. If the internet connection or the specific path to FortiGuard is unstable (packet loss, latency), queries will time out. This results in " Rating Errors, " which can block or allow traffic unpredictably based on the " Allow websites when a rating error occurs " setting.
Why other options are incorrect:
A: A mismatch in inspection mode (e.g., Profile set to Proxy, Policy set to Flow) is a static configuration error. It would typically result in the profile not being selectable or consistently failing/not applying, rather than working intermittently.
C: If the wrong port is mapped (e.g., HTTP on 8080 is not mapped), the inspection engine will consistently ignore traffic on that port. It would not be intermittent.
[Reference:, FortiGate Security 7.6 Study Guide (Web Filter): "If the connection to FortiGuard is unstable, users may experience delays or rating errors... Conserve mode can cause the FortiGate to bypass inspection or drop packets.", , , ]
