Kerio Control Web Filter Is Not Activated Categorization Is Disabled - Hot
Navigate to Content Filter > Applications and Web Categories .
Follow these solutions in order to resolve the issue and reactivate your web filtering capabilities. 1. Verify License Status and Maintenance Validity
: Open Logs > Error . You should no longer see "DNS response timeout" linked with "Web Filter categorization disabled".
At its heart, Kerio Control's Web Filter relies on a third-party service, currently provided by , to maintain a dynamic, real-time database of website categorizations. When a user requests a webpage, the firewall sends a query to this service. The service responds with the page's category (e.g., "Social Networking," "Streaming Media," "Productivity"). Based on this rating and your predefined content rules, Kerio Control either allows or denies the connection. Navigate to Content Filter > Applications and Web Categories
Note: This forces the filter to stay active even if it has trouble reaching the update servers. Configuration Check
Once you deploy these configuration changes, verify that classifications are working by navigating to > Applications and Web Categories . Checkpoint Metric Action Item Target Log File Location Active Switch Check Enable Kerio Control Web Filter box. Admin Interface Configuration System Classification
: Kerio Control relies on DNS to communicate with the Zvelo update servers for web categorization. Unreliable ISP connections, slow internet link speeds, or incorrect DNS forwarding settings can cause these automated checks to fail. This is a frequent root cause of the categorization disabled error. Verify License Status and Maintenance Validity : Open
The most basic, yet frequently overlooked, cause for a disabled web filter is licensing. The Kerio Control Web Filter requires a specialized premium subscription module.
: An incorrectly set system date and time on the Kerio Control server can break HTTPS/TLS certificate validation, preventing the license validation and communication with cloud-based filtering services. A failed DNS lookup for the DiaServerUrl (e.g., v4.url.zvelo.com ) can also cause the authorization token (which expires every 21 days) to fail.
If it says Expired or Not Licensed , you must purchase a renewal or apply a valid license key. When a user requests a webpage, the firewall
: Avoid using Google's DNS (8.8.8.8) as custom forwarding servers for these requests. Use Cloudflare ( 1.1.1.1 ) or OpenDNS ( 208.67.222.222 ) instead.
To resolve this "disabled" state, administrators often use the following official GFI Support steps:
When you see "categorization is disabled hot ," the engine is screaming for attention. It has fresh cached data but cannot authenticate or download differential updates. In this state, all categories show as "Uncategorized," meaning your rules (e.g., "Block Adult Content") will not match anything.
One of the most common administrative headaches in Kerio Control environments is encountering a state where the Web Filter module reports that it is and "Categorization is Disabled." This state effectively renders Content-Aware Firewall policies useless, leaving the network vulnerable to malware, phishing, and productivity drains. This write-up explores the root causes of this issue and provides a step-by-step resolution guide.