Allow these destinations from the Kerio Control appliance (not just LAN clients):
The message indicates Kerio Control’s web filtering isn’t functioning because URL categorization is disabled or unreachable, which disables policy-based filtering and reporting. Investigate licensing, connectivity to categorization services, configuration, system time/certificates, software version, and resource usage; then re-enable the feature, restore connectivity, renew licenses, rebuild caches, update software, and verify operation. If unresolved, collect logs and contact vendor support.
If you want, I can produce a tailored checklist or step-by-step script for your specific Kerio Control version and environment—tell me the appliance OS/version, whether you use cloud categorization, and any recent changes.
Kerio Control Web Filter Not Activated: Categorization Disabled
Issue Overview
The Kerio Control web filter is a crucial component of the Kerio Control software, which provides comprehensive internet security and content filtering for organizations. However, in this case, the web filter is not activated, and categorization is disabled, which can lead to security vulnerabilities and reduced productivity.
Possible Causes
Some possible causes of this issue include:
Consequences
The consequences of having an inactive web filter and disabled categorization include:
Recommendations
To resolve this issue, we recommend:
Best Practices
To prevent similar issues in the future, we recommend:
The error message "Kerio Control Web Filter is not activated; categorization is disabled" typically occurs when the firewall cannot reach its external categorization servers or has encountered a licensing/authorization failure. This issue is a common pain point for administrators using the GFI Kerio Control Unified Threat Management (UTM) solution. Core Issue Overview
The Kerio Control Web Filter relies on a third-party service called Zvelo to categorize URLs. When the filter shows as "not activated," it means the local Kerio appliance is unable to verify categories for websites, effectively disabling content-based blocking rules. Common Root Causes
DNS Failures: Kerio Control performs automatic DNS health checks. If 10 consecutive queries fail within one minute, the system marks the Web Filter as "not reliable" and disables it. Allow these destinations from the Kerio Control appliance
Invalid Authorization: This often stems from an expired Zvelo token (which typically expires after 21 days). If the appliance cannot fetch a new token from Kerio’s internal servers, the filter remains inactive.
ISP Restrictions: Some ISPs limit the frequency of DNS requests, which can trigger reliability errors since the web filter makes numerous requests to zvelo.com for categorization. Troubleshooting & Fixes
To resolve this "disabled" state, administrators often use the following official GFI Support steps:
Change DNS Servers: Switch your custom DNS forwarders to stable providers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) specifically for *.zvelo.com traffic.
Disable Reliability Detection: If the filter stays disabled due to minor network blips, you can use SSH to run:./tinydbclient "update SiteFilter set DetectReliability=0"This prevents the system from automatically disabling the filter when it perceives the connection as unreliable.
Manual Activation: Ensure the filter is toggled on under Content Filter > Applications and Web Categories in the administration interface. User Experience Impact
Pros: When active, the filter provides robust, color-coded rule management and automated blocking of malicious sites, ads, and peer-to-peer networks.
Cons: Users report that when the filter is "disabled," the entire security policy for web access may fail open or closed depending on configuration, leading to either security gaps or frustrated users unable to access legit sites. Consequences The consequences of having an inactive web
Are you currently facing this error on a hardware appliance or a virtual machine? Using Kerio Control Web Filter - KerioControl - GFI
One of the most common administrative headaches in Kerio Control environments is encountering a state where the Web Filter module reports that it is "Not Activated" and "Categorization is Disabled." This state effectively renders Content-Aware Firewall policies useless, leaving the network vulnerable to malware, phishing, and productivity drains. This write-up explores the root causes of this issue and provides a step-by-step resolution guide.
To resolve the problem, it is first necessary to understand what the error messages actually mean:
SSL certificate validation for HTTPS calls to GFI servers will fail if the system clock is off by more than a few minutes.
Check Configuration → Advanced → Date & Time.
After fixing time, restart filtering service.
Go to Status → Services.
Ensure the following services are Running: Recommendations To resolve this issue, we recommend:
If stopped, start them manually. If they crash immediately, proceed to debug logs (Step 7).