Disabled Hot Work - Kerio Control Web Filter Is Not Activated Categorization Is

To resolve the issue where the Kerio Control Web Filter is reported as not activated and categorization is disabled, you typically need to address underlying DNS or authorization issues. This error often occurs when the firewall cannot reach the Zvelo categorization servers. Immediate Fixes

Restart Kerio Control: In many cases, a simple reboot restores connectivity and reactivates the filter automatically.

Manual Activation: Ensure the filter is checked in the administration interface under Content Filter > Applications and Web Categories. Troubleshooting DNS and Authorization

The "categorization disabled" state is often a reliability safety measure triggered after multiple failed DNS queries. Configure Custom DNS Forwarding: Go to DNS in the admin interface. Enable custom DNS forwarding for *.zvelo.com.

Set the DNS servers to Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222), as Google's DNS can sometimes cause authorization token issues.

Check for Expired Tokens: Zvelo key tokens expire every 21 days. If your firewall has been offline or has incorrect time settings, it may fail to update this token. Advanced CLI Solution (If Reliability Check is Stuck) To resolve the issue where the Kerio Control

If the filter remains disabled after a restart, you can manually reset the reliability detection via SSH: Login to the console via SSH. Navigate to the directory: cd /opt/kerio/winroute.

Run the following command to disable the reliability check:./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart.

Note: If your 30-day trial has expired, these options will be greyed out and unavailable until a valid license is applied.

Web Filter categorization disabled. Serial number: ko-197974

This error indicates that Kerio Control cannot verify its license or reach the categorization servers, typically due to DNS timeouts license expiration support.keriocontrol.gfi.com Quick Fixes Check DNS Forwarders : Use reliable DNS servers like Cloudflare (1.1.1.1) or Users can bypass content restrictions because requests are

(208.67.222.222). Avoid using Google DNS (8.8.8.8) for Zvelo lookups as it can cause authorization failures support.keriocontrol.gfi.com Restart the System

: Rebooting Kerio Control often restores the link to the update servers support.keriocontrol.gfi.com Verify License

: Ensure your Kerio Control Web Filter license is active. Without it, the module disables itself 30 days after installation GFI Support Advanced SSH Resolution

If the error persists despite a stable internet connection, Kerio Control's "Reliability Detection" may have permanently disabled the filter after 10 failed connection attempts support.keriocontrol.gfi.com . You can reset this via support.keriocontrol.gfi.com Log in to Kerio Control via SSH (e.g., using support.keriocontrol.gfi.com Navigate to the directory cd /opt/kerio/winroute Disable Reliability detection and reset the timers: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the engine /etc/boxinit support.keriocontrol.gfi.com Configuration Check In the administration interface, go to Content Filter Applications and Web Categories support.keriocontrol.gfi.com Enable Kerio Control Web Filter is checked GFI Support If a specific site is still blocked erroneously, use the

feature in this same tab to report the miscategorization to Zvelo support.keriocontrol.gfi.com Step 1: Validate the License

Does your current license show as active under the Dashboard/Status section? Using Kerio Control Web Filter

4. Diagnostic Steps

Why this is a problem

  • Users can bypass content restrictions because requests are not being categorized or blocked.
  • Reporting and logs will not show accurate category labels, reducing visibility into web usage.
  • Compliance or acceptable-use policies may be violated.
  • It may indicate licensing, connectivity, or configuration issues that could affect other services.

What Does "Categorization is Disabled" Mean?

When categorization is disabled, Kerio Control cannot assign a category to any requested URL. Consequently:

  • Rules using "Web Filter" as a condition are ignored.
  • The firewall falls back to basic allow/deny rules based on IP addresses, ports, or raw domains if defined.

In most configurations, this leads to either:

  • Overly permissive access (if your default rule is Allow) – users can visit blocked categories.
  • Overly restrictive access (if your default rule is Deny) – legitimate business sites get blocked.

When to consider alternate approaches

  • If cloud categorization proves unreliable for your environment, consider:
    • Using a local/category cache appliance (if supported).
    • Combining Kerio with a secondary on-premises proxy that performs categorization.
    • Implementing URL allow/block lists as a temporary measure.

Understanding Kerio Control

Kerio Control is a comprehensive network security solution that provides firewall protection, VPN, and content filtering. The web filter is a crucial component that allows administrators to control and monitor internet access, block specific web categories, and ensure that users are not accessing inappropriate or harmful content.

Step 8: Disable & Re-Enable Web Filter Feature

Sometimes a simple toggle resets the activation state.

  1. Go to Configuration → Web Filter.
  2. Uncheck Enable Web Filter.
  3. Click Save.
  4. Wait 30 seconds.
  5. Re-check Enable Web Filter.
  6. Save again.

Observe the dashboard – the error should disappear within 2 minutes.

Step 1: Validate the License

  • Log into the Kerio Control Administration Console (or web interface).
  • Go to Status > License Information.
  • Look for "URL Database" .
  • Action: If expired, purchase a renewal. If active but showing "0 days left," hit Refresh License via the support.keriocontrol.com portal.