Kerio Control - Web Filter Is Not Activated Categorization Is Disabled Work

This specific error in Kerio Control typically occurs when the firewall loses its connection to the categorization servers or encounters a DNS timeout

, causing the Web Filter to enter a "not activated" or "disabled" state for safety. support.keriocontrol.gfi.com Why this happens DNS Failures

: Kerio Control sends periodic queries to reach update servers. If it fails 10 times in a row within 1 minute, it disables the filter. Invalid Authorization

: The Zvelo key token may have expired (typically every 21 days) or is blocked by your ISP's DNS. Slow Connectivity

: High latency or slow internet links can prevent the filter from verifying site categories in real-time. support.keriocontrol.gfi.com How to fix it Change DNS Forwarders

Switch your firewall's custom DNS servers to more reliable ones like Cloudflare 208.67.222.222 ) to ensure *.zvelo.com URLs can be resolved. Restart the Kerio Control Engine

A simple restart of the firewall often restores connectivity and resets the failure counters. Disable "Detect Reliability" (via SSH)

If the error persists due to an unstable internet connection, you can force the filter to stay active by disabling its "Reliability" check: Log in to the console via cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart Verify License Activation Ensure your license or Software Maintenance (SWM)

hasn't expired, as an expired license will immediately turn off content filtering functions. support.keriocontrol.gfi.com Do you need the specific SSH login commands or help checking your DNS forwarder settings in the admin interface?

Web Filter categorization disabled. Serial number: ko-197974

This issue typically occurs when Kerio Control loses connectivity to its categorization servers (Zvelo) or fails internal reliability checks. Quick Fixes

Verify Basic Activation: Ensure the feature is actually toggled on. Go to Content Filter > Applications and Web Categories and verify Enable Kerio Control Web Filter is checked.

Check DNS Forwarding: The Web Filter relies on reaching *.zvelo.com. Configure custom DNS forwarding for this domain to reliable servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) rather than internal or ISP servers that might time out.

Reboot the Appliance: A simple restart can often clear temporary authorization token failures or DNS timeouts. Advanced Troubleshooting (via SSH)

If the Web Filter shows as "not activated" even with a valid license, Kerio may have disabled it due to detected unreliability (e.g., more than 10 failed DNS check queries in one minute). To force-enable the service and bypass reliability checks:

Enable SSH: Hold Shift while clicking Status > System Health in the admin interface and click Enable SSH. Connect via SSH using an app like PuTTY.

Run the following commands to disable reliability detection and restart the service:

cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard Other Potential Causes

License/Token Expiry: Authorization tokens for categorization expire every 21 days. If they fail to renew due to blocked traffic, categorization will disable.

Guest Network Limitations: Note that the Kerio Control Web Filter is disabled by default for the guest network interface.

Are you seeing any specific error logs (like "Invalid Authorization" or "DNS response timeout") in the Error or Debug logs? Using Kerio Control Web Filter - KerioControl - GFI

Before contacting support, gather:

Support may provide a hotfix or confirm a known bug.

Sometimes the service itself is turned off manually or due to a configuration error.