The error "Kerio Control Web Filter is reported to be not activated, and categorization is disabled" usually stems from invalid authorization (expired tokens) or DNS reliability issues. Fix 1: Resolve Invalid Authorization (Expired Zvelo Tokens)
This error typically means an expired Zvelo key token (which expires every 21 days) is being used.
Check DNS Forwarders: Do not use Google's DNS (8.8.8.8) as the primary forwarder for *.zvelo.com.
Use Alternative DNS: Set Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for zvelo URLs.
Verify Configuration: Access the SSH console and ensure the correct DiaServerUrl (v4.url.zvelo.com) is in /opt/kerio/winroute/winroute.cfg.
Reboot: Restart the Kerio Control appliance after making DNS changes. Fix 2: Disable Reliability Detection via SSH
If the Web Filter disables itself because of DNS timeouts, you can force it to stay active by disabling the reliability check. Log in to the Kerio Control console via SSH. Navigate to the winroute directory:cd /opt/kerio/winroute
Execute the following command to disable detection:./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service:/etc/boxinit.d/60winroute restart. Fix 3: Basic License & Manual Re-activation
Verify License: Ensure your Kerio Control Web Filter license hasn't expired, as it will automatically disable after 30 days of trial or upon expiration.
Toggle Settings: In the admin interface, go to Content Filter > Applications and Web Categories. Uncheck and then re-check Enable Kerio Control Web Filter, then click Apply.
Web Filter categorization disabled. Serial number: ko-197974
This article addresses the common "Kerio Control Web Filter is not activated; categorization is disabled" error. This issue typically prevents the firewall from effectively blocking or allowing websites based on their category, leaving your network vulnerable or causing connectivity disruptions. Understanding the Error
The "categorization is disabled" status occurs when the Kerio Control engine cannot verify its license or communicate with the backend categorization service, which is powered by Zvelo. This results in the filter failing to identify the nature of web traffic (e.g., social media, gambling, malware), often defaulting to a "not activated" state. Phase 1: Troubleshooting License and Activation
Before diving into technical commands, ensure the software is correctly registered and the license is current. The error "Kerio Control Web Filter is reported
Verify License Status: Log in to the Kerio Control Administration interface and check the Dashboard. If it shows as "unregistered" or "trial expired," the Web Filter will automatically disable after 30 days.
Renew Key Tokens: The Web Filter uses a Zvelo key token that expires every 21 days. If your firewall hasn't been able to reach the registration servers, this token will lapse.
Manual Registration: If online activation fails, you can download a .key file from the Kerio Product Registration page and import it via Configuration Assistant > Register product > Register offline by license file. Phase 2: Fixing Connectivity and DNS Issues
The Web Filter relies heavily on DNS to communicate with the Zvelo servers. Incorrect DNS settings are a frequent cause of "Invalid Authorization" errors.
Change Custom DNS Forwarders: Using Google DNS (8.8.8.8) can sometimes cause authorization failures with Zvelo URLs. It is recommended to use: Cloudflare: 1.1.1.1 OpenDNS: 208.67.222.222 or 208.67.220.220.
Check Zvelo Server URL: Through the SSH console, verify that the DiaServerUrl in /opt/kerio/winroute/winroute.cfg is set to v4.url.zvelo.com. Phase 3: Technical Fix via SSH
If the Web Filter remains disabled due to "Reliability detection" (where the firewall stops checking categorization if it thinks the connection is unstable), you can force it to stay active.
Enable SSH: In the administration interface, go to Advanced Options > SSH and enable it.
Connect to Console: Use a client like PuTTY to SSH into your Kerio Control appliance. Execute the Fix:
cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution.
This command disables the feature that shuts down categorization during minor network timeouts, keeping the filter active. Phase 4: Enabling and Testing the Filter
Once the underlying connection or license issue is resolved, you must re-enable the filter:
Navigate: Go to Content Filter > Applications and Web Categories. Enable: Check the box for Enable Kerio Control Web Filter. Check:
Apply Content Rules: Ensure your Content Rules tab has the predefined rule for "Kerio Control Web Filter categories and applications" enabled.
Test a URL: Use the Test URL tool in the same tab to verify if a site (e.g., facebook.com) is correctly categorized. Summary of Quick Fixes Primary Fix Invalid Authorization Error Switch DNS to Cloudflare (1.1.1.1) and reboot. Trial Expired/Disabled Purchase/import a valid license key. Frequent Timeouts/Disabling Disable "DetectReliability" via SSH command. Categorization Not Active
Ensure "Kerio Control Web Filter" is checked in Content Filter settings.
Review and verify the Web Filter configuration to ensure it is set up correctly.
If nothing works, the configuration database itself may have inconsistent flags. This is a nuclear option.
.cfg backup.Note: Reset only after you have exhausted all other options.
The most common cause is a licensing hiccup. Even if you believe your license is valid, the system needs to verify this with the activation servers.
| Symptom | Likely Fix | |---------|-------------| | Web filter not activated | Apply/renew Security Pack license | | Categorization disabled | Trigger manual DB update; fix internet access to update server | | Works for HTTP but not HTTPS | Enable SSL inspection | | Works for some users, not others | Check traffic rule web filter setting | | Never works after fresh install | Reinstall web filter component |
If after all these steps the problem persists, collect Kerio Control support bundle (Status → Support Bundle) and open a ticket with GFI Support – they can check if the internal categorization daemon fails to start due to a deeper system issue.
When your Kerio Control Web Filter shows as "not activated" and categorization is disabled, it is typically caused by license issues, DNS resolution failures, or an expired Zvelo authorization token. 🛠️ Step-by-Step Fixes 1. Fix DNS Forwarding for Zvelo
The Web Filter uses Zvelo for categorization. If your DNS cannot resolve *.zvelo.com, the filter disables itself for reliability.
Recommendation: Avoid using Google DNS (8.8.8.8) for Zvelo queries, as it can cause "Invalid Authorization" errors.
Action: Go to DNS settings and configure Custom DNS forwarding for *.zvelo.com to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222). Go to Status → License Information
Look for:
Reboot: You must restart Kerio Control after changing these DNS settings to clear the cached status. 2. Disable "Reliability Detection" (SSH)
If your internet link is slow or unstable, Kerio may proactively disable the filter. You can force it to stay active via the SSH console: SSH into your Kerio appliance.
Navigate to the configuration directory: cd /opt/kerio/winroute. Run this command to disable reliability checks: ./tinydbclient "update SiteFilter set DetectReliability=0" Use code with caution. Copied to clipboard Restart the service: /etc/boxinit.d/60winroute restart. 3. Verify License & Module Activation
The Web Filter is a separate licensed module. If the license is missing or expired, the options will be greyed out.
Check Status: Look at the Dashboard license tile to ensure it's not in "Trial" or "Unregistered" mode.
Renewal: If you recently renewed, you might need to manually download the license file from the GFI Accounts portal and import it via the Registration Wizard. 4. Check Zvelo Token Expiry
The categorization token expires every 21 days. If Kerio cannot reach internal update servers to refresh it, authorization fails.
Ensure your firewall allows outgoing traffic on Port 443 (HTTPS) and Port 80 (HTTP) to Kerio's update servers.
💡 Quick Pro-Tip: If the filter is active but specific sites are still failing, try enabling HTTPS Decryption in the Content Filter settings; otherwise, the filter cannot see the full URL to categorize it.
If you're still having trouble, I can help you look at your logs. Could you tell me:
What specific error message appears in your Warning or Error logs?
Is your License currently showing as active or expired on the Dashboard? Which version of Kerio Control are you currently running?
Web Filter categorization disabled. Serial number: ko-197974
The web filter relies on URL categorization databases. If categorization is disabled or fails to load, the filter won’t activate.