Find a new daily game, every day.

Kerio Control Web Filter Is Not Activated Categorization Is Disabled Work Now

If you are encountering the error "Kerio Control Web Filter is not activated; categorization is disabled," your firewall has likely triggered a safety mechanism that pauses web filtering when it cannot reliably reach the categorization servers.

This issue is typically caused by unstable DNS connections, expired authentication tokens, or network reliability checks failing multiple times in a row. Use the following guide to troubleshoot and implement workarounds. 1. Immediate Workaround: Disable Reliability Detection

Kerio Control is designed to disable the Web Filter if it fails 10 consecutive DNS checks to reach the update servers within one minute. You can force it to ignore these failures and keep the filter active by using the SSH console. Steps to disable reliability detection:

Enable SSH: Hold the Shift key while navigating to Status > System Health in the admin interface, then click Enable SSH.

Access the Shell: Connect to your Kerio device via SSH (e.g., using PuTTY ). Run these commands:

cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution.

Note: This will restart the Kerio Control service and may cause a brief internet interruption. 2. Resolve "Invalid Authorization" and Token Errors

The Web Filter uses an external service (Zvelo) which requires a valid authorization token. These tokens expire every 21 days. If your DNS settings prevent the token from renewing, categorization will be disabled.

Change DNS Forwarding: Do not use Google DNS (8.8.8.8) for all requests, as it can sometimes cause issues with Zvelo authentication.

Configure Custom Forwarding: Navigate to Configuration > DNS. Check Enable custom DNS forwarding and add a rule for *.zvelo.com to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) instead. 3. Fix Licensing and Activation Issues

The Web Filter requires a specific active license; without it, the module behaves as a trial and will automatically disable after 30 days.

Check Subscription Status: In the GFI Accounts Portal , verify your license is not expired.

Offline Registration: If the online activation fails due to network issues, download the license file from the Kerio Product Registration page and use the Register Offline option in the Kerio Activation Wizard.

Check Disk Space: A full disk can prevent the license file from saving. Use SSH to check disk space and clear cache files in /var/lib/firebase if necessary. 4. Troubleshooting Miscategorized or Blocked Sites

If the filter is activated but still blocking legitimate sites, you can bypass the categorization engine for specific URLs. Using Kerio Control Web Filter

The "Kerio Control Web Filter is not activated / categorization is disabled" issue typically stems from connectivity failures to backend servers or license validation errors. Primary Causes and Solutions

DNS Reliability Issues: Kerio Control performs automatic DNS checks to reach update servers. If 10 consecutive queries fail within one minute, the system marks the Web Filter as "not reliable" and disables categorization.

Fix: You can disable this reliability detection via the SSH console with these commands: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart

Expired or Invalid Authorization: An "Invalid Authorization" error often occurs if an expired Zvelo key token (which lasts 21 days) is used.

Fix: Update your DNS configuration to use reliable third-party servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) for *.zvelo.com URLs.

Licensing Constraints: The Web Filter requires a specific license and will automatically disable after a 30-day trial period if not activated.

Fix: Verify your license status in the GFI KISS portal and ensure the "Download Limit" has not been reached.

Network Timeouts: Intermittent ISP issues or slow connection speeds can trigger the "categorization disabled" state.

Fix: The service usually attempts to revert to normal after one hour of stable connectivity. Basic Configuration Check Ensure the filter is actually enabled in the UI:

Navigate to Content Filter > Applications and Web Categories. Verify Enable Kerio Control Web Filter is checked. Click Apply to save changes.

Web Filter categorization disabled. Serial number: ko-197974

Leo stared at the blinking green cursor on his terminal, the words "Kerio Control: Web Filter not activated. Categorization is disabled." burning like a warning flare.

He was the sysadmin at a small, progressive high school, "The Horizon Academy." The school board had just approved a "responsible digital citizenship" curriculum, which meant Leo was supposed to disable the old, draconian web filter. Their theory: teach kids to self-regulate, not just block them. Leo’s job was to make the network functional but unfiltered.

But the Kerio Control box was ancient, a cranky little server that had been patched, rebooted, and cursed at for five years. When Leo clicked "Save" on the new, filter-less policy, the system didn't just turn off protection—it threw an error. Specifically:

"Kerio Control: Web Filter not activated. Categorization is disabled."

Leo shrugged. That was the goal, right?

He was wrong.

Monday, 8:15 AM

The first wave was innocent. A freshman in Ms. Albright’s history class searched for "Roman Empire engineering." Without categorization, the filter didn't know if this was "Education" or "Weapons." The system defaulted to a limbo state—it let everything through, but it also forgot how to cache or prioritize.

The student’s query hit the main server, then bounced to an ad network, then to a CDN in Moldova, then back. The round trip took 14 seconds. Ms. Albright’s smartboard froze, displaying a spinning wheel of death over a pixelated image of a Roman aqueduct.

Tuesday, 10:20 AM

Mr. Henderson in the library noticed it next. Students researching "endangered species" were being served ads for exotic leather boots. Without content categorization, the traffic shaper had no idea what was payload and what was noise. The school’s 500 Mbps pipe was suddenly acting like DSL. If you are encountering the error "Kerio Control

"Why is YouTube buffering?" a student whined.

"It's not YouTube," Leo muttered, pulling up Kerio’s raw logs. The logs were a screaming kaleidoscope of IP addresses: 45% legitimate school traffic, 55% botnets, cryptominers, and zombie click-farms that had slipped in because no filter was there to blacklist known malicious domains.

Kerio wasn't just a wall; it was a traffic cop. And the cop had gone home.

Wednesday, 1:00 PM – The Boiling Point

The new AI-powered grading platform, "GradeSwift," went down. Every teacher in the building lost their progress reports. The cause? Without bandwidth categorization, a single student’s background torrent client (which he thought he’d closed) opened 8,000 concurrent connections to a seedbox in Luxembourg. Kerio, confused, treated the torrent packets with the same priority as the principal’s Zoom call with the district superintendent.

The call dropped. The superintendent was mid-sentence.

Then came the other problem. Since categorization was disabled, the "safe search" enforcement was also off. A seventh-grader innocently searching for "swim team" was shown results that would make a sailor blush. The filter wasn't blocking bad things; it also wasn't blocking inappropriate things that looked like innocent things.

The principal, Dr. Evans, stormed into Leo's office. "Leo. A parent just called. Their child searched for 'how to build a birdhouse' and got a pop-up for… well, for things you build with birdseed, but not that kind."

Leo stared at the Kerio dashboard. The message was still there, mocking him:

"Web Filter not activated. Categorization is disabled."

He finally understood. "Disabled" didn't mean "open and free." It meant "chaotic and blind." The filter’s absence hadn't created a utopia of self-regulation; it had created a digital jungle where nothing worked right, everything was slow, and the worst stuff rose to the top because there was nothing to push it down.

The Fix

That night, Leo didn't turn the filter back on. Instead, he wrote a 17-line script. It didn't enable categorization. It did something smarter. He set Kerio to a "Log-Only" mode with a custom rule: If categorization is disabled, then throttle all un-categorized traffic to 1kbps and route it to a local cache that updates every 10 seconds.

It was a hack, a Frankenstein solution. But when he hit "Apply," the terminal blinked once.

Status: Web Filter – Custom Policy. Categorization – Bypassed. Work – Resume.

The spinning wheels stopped. The principal’s Zoom reconnected. The torrent client was reduced to a sad, slow trickle. And the seventh-grader’s search for "swim team" now just showed photos of a local pool's schedule.

Leo leaned back. The Kerio box hummed quietly. It wasn't fixed. It was working—despite being broken. And sometimes, that’s the best a sysadmin can hope for.

He printed the error message from Monday and taped it to his monitor. It became his motto: "Not activated. Disabled. But it works."

Because in the end, a good admin doesn't need the filter. He just needs the feeling of the filter—and a really clever script.

This report addresses the issue where the Kerio Control Web Filter is reported as "not activated" or "categorization is disabled," causing internet connectivity issues or a failure to apply content filtering rules. 1. Diagnosis & Root Causes Web Filter Service Failure (Zvelo):

Kerio Control uses Zvelo to categorize websites. If the service fails to get updates, it disables categorization. DNS Resolution Issues: Web Filter needs to reach *.zvelo.com

URLs. If custom DNS servers (like Google 8.8.8.8) are slow, it can trigger a "DNS response timeout". Expired License:

Subscription renewal is necessary for Web Filter to function. Corrupted/Invalid Authorization: Expired Zvelo token (expires every 21 days) or corrupted winroute.cfg support.keriocontrol.gfi.com 2. Immediate Workarounds & Fixes A. Fix DNS and Connectivity Change DNS Servers: Ensure your DNS servers are robust. Cloudflare ( ) or OpenDNS ( 208.67.222.222 ) are recommended for better *.zvelo.com resolution. Restart Kerio Control: A simple reboot often restores functionality. support.keriocontrol.gfi.com B. Fix "Categorization is Disabled" via SSH

If the filter stays disabled, manually reset the reliability detection, which might be wrongly flagging the filter as "not working." Login via SSH:

Connect to the Kerio Control console using a tool like PuTTY. Run Commands: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard

This disables the reliability check that turns off the filter after DNS issues. support.keriocontrol.gfi.com C. Fix "Invalid Authorization" (Expired Token) If logs show DNS response 'FAILURE: Invalid authorization' , update the winroute.cfg to ensure the correct Zvelo server is used: Access Configuration: Access the configuration file winroute.cfg through SSH. Verify URL: DiaServerUrl v4.url.zvelo.com Reboot the machine after verifying. support.keriocontrol.gfi.com 3. Verification & Activation Activate/Re-enable: Content Filter > Applications and Web Categories and verify "Enable Kerio Control Web Filter" is checked. Check Licenses: Verify the Subscription/License validity on the Dashboard. Check Logs: Review the Security log for errors related to categorization. GFI Support 4. Long-Term Solutions Verify Subscription: Contact GFI Sales if the license is expired. Check Disk Space:

A "cannot load new license file" error often results from a full disk. Clear cache files if necessary. Use URL Whitelist: If a site is blocked incorrectly, use the Content Filter > Applications and Web Categories > Add feature to whitelist it directly. support.keriocontrol.gfi.com Using Kerio Control Web Filter

The message "Kerio Control Web Filter is not activated; categorization is disabled"

typically indicates that the firewall has lost connection to the external categorization service (Zvelo) or has a licensing/reliability issue support.keriocontrol.gfi.com Primary Causes and Solutions 1. Connection Reliability Detection

Kerio Control periodically checks its connection to update servers via DNS. If these checks fail 10 times in a row within one minute, it marks the Web Filter as "not reliable" and disables categorization. support.keriocontrol.gfi.com The "Wait" Fix

: Functionality often restores itself after one hour of stable connection. The Command Fix

: If it doesn't restore, you can disable the reliability check via SSH using these GFI Support instructions: SSH into your Kerio Control console. Navigate to: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart support.keriocontrol.gfi.com 2. DNS Resolution Issues If Kerio cannot resolve *.zvelo.com or other update URLs, categorization will fail. support.keriocontrol.gfi.com : Set a custom DNS forward for *.zvelo.com to use reliable public servers like Cloudflare 208.67.222.222 ) in the DNS section of the admin interface. support.keriocontrol.gfi.com 3. License and Token Expiration Module License

: The Web Filter requires a specific license. Without it, the module is automatically disabled 30 days after installation. Invalid Authorization

: This often means the Zvelo token (which expires every 21 days) is invalid. Ensure your firewall can reach the Kerio Registration Server to refresh these tokens automatically. GFI Support Verification Steps

To ensure the filter is correctly set up once the activation issue is resolved: Enable the Filter : Navigate to Content Filter Applications and Web Categories and ensure Enable Kerio Control Web Filter is checked. Test a URL

feature in the same tab to see if a website is correctly categorized (e.g., "Social Networks"). Check Rules : Ensure your Content Rules (under Content Filter Content Rules Leo stared at the blinking green cursor on

) are using these categories correctly; if the filter is inactive, these rules will appear greyed out. GFI Support to run those database commands? Using Kerio Control Web Filter

When your Kerio Control Web Filter displays a "not activated" status or states that "categorization is disabled," it usually stems from a connectivity failure between your firewall and the Zvelo categorization servers.

If a simple restart doesn't fix it, follow these steps to restore functionality: 1. Resolve Connectivity & Reliability Issues

Kerio Control will disable the Web Filter if it fails to receive a DNS response from update servers 10 times in a row. This is a safety mechanism to prevent network hangs when the filter isn't "reliable."

Temporary Fix: Restart the Kerio Control appliance to restore immediate internet access.

Permanent Fix (via SSH): To prevent future automatic disabling, you must disable the DetectReliability feature: Access the Kerio Control shell via SSH. Navigate to the directory: cd /opt/kerio/winroute.

Execute this command to disable reliability detection:./tinydbclient "update SiteFilter set DetectReliability=0". Restart the engine: /etc/boxinit.d/60winroute restart. 2. Update DNS Forwarding Servers

If you are using Google's DNS (8.8.8.8), you might encounter "Invalid Authorization" errors because Zvelo key tokens expire every 21 days and may fail to refresh through these servers.

Solution: Change your custom DNS forwarding servers for *.zvelo.com to Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222).

Action: Update these settings in Configuration > DNS, then reboot the appliance. 3. Verify License & Activation Status

The Web Filter requires a specific active license module. If your core license is valid but the filter is "not activated," it may be a module-specific expiration.

Check Status: Go to the Dashboard in the Kerio Control Administration interface to verify the license expiration date.

Re-enable Manually: Sometimes the filter just needs to be toggled:

Navigate to Content Filter > Applications and Web Categories. Uncheck and re-check Enable Kerio Control Web Filter. Click Apply. 4. Advanced Troubleshooting: HTTPS & Wildcards

If specific sites still aren't being categorized correctly or are blocked despite being whitelisted:

Enable HTTPS Decryption: The filter cannot categorize encrypted traffic without HTTPS decryption enabled under Content Filter > HTTPS Filtering.

Wildcard Handling: If you whitelist a domain, ensure you use a trailing wildcard (e.g., *.domain.com/*) to capture all sub-paths. Using Kerio Control Web Filter

This issue typically occurs when Kerio Control loses connectivity to its categorization servers (Zvelo) or fails internal reliability checks. Quick Fixes

Verify Basic Activation: Ensure the feature is actually toggled on. Go to Content Filter > Applications and Web Categories and verify Enable Kerio Control Web Filter is checked.

Check DNS Forwarding: The Web Filter relies on reaching *.zvelo.com. Configure custom DNS forwarding for this domain to reliable servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) rather than internal or ISP servers that might time out.

Reboot the Appliance: A simple restart can often clear temporary authorization token failures or DNS timeouts. Advanced Troubleshooting (via SSH)

If the Web Filter shows as "not activated" even with a valid license, Kerio may have disabled it due to detected unreliability (e.g., more than 10 failed DNS check queries in one minute). To force-enable the service and bypass reliability checks:

Enable SSH: Hold Shift while clicking Status > System Health in the admin interface and click Enable SSH. Connect via SSH using an app like PuTTY.

Run the following commands to disable reliability detection and restart the service:

cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard Other Potential Causes

License/Token Expiry: Authorization tokens for categorization expire every 21 days. If they fail to renew due to blocked traffic, categorization will disable.

Guest Network Limitations: Note that the Kerio Control Web Filter is disabled by default for the guest network interface.

Are you seeing any specific error logs (like "Invalid Authorization" or "DNS response timeout") in the Error or Debug logs? Using Kerio Control Web Filter - KerioControl - GFI

When Kerio Control displays the error "Web Filter is not activated" or "categorization is disabled," it typically indicates a breakdown in communication between your firewall and the zvelo categorization servers or an expired license component. This effectively disables category-based filtering rules, leaving your network exposed. Primary Causes and Solutions

DNS Reliability Check Failures: Kerio Control performs automated DNS checks to verify connectivity to update servers. If these queries fail 10 times consecutively within one minute, the system marks the Web Filter as "unreliable" and disables it.

Fix: You can disable this "Reliability detection" via the SSH console by navigating to /opt/kerio/winroute and executing:./tinydbclient "update SiteFilter set DetectReliability=0".

DNS Forwarding Issues: Using certain DNS providers (like Google's 8.8.8.8) can occasionally cause categorization failures.

Recommendation: Use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers specifically for *.zvelo.com domains.

Expired Authorization Tokens: Categorization relies on a security token that expires every 21 days. If your firewall cannot reach the internal GFI/Kerio servers to refresh this token, categorization will stop working.

Licensing Constraints: The Kerio Control Web Filter is a separate licensed module. If your main license does not include this add-on, or if you are 30 days past installation without a valid key, the feature will be automatically disabled. Immediate Troubleshooting Steps

Check License Status: In the Kerio Control Webadmin Dashboard, verify that the "Kerio Control Web Filter" component shows as active and has not exceeded its download limits. Monday, 8:15 AM The first wave was innocent

Verify Configuration: Ensure the filter is explicitly enabled under Content Filter > Applications and Web Categories.

Perform a Test URL: Use the "Test URL" tool in the administration interface to see if the firewall can successfully categorize a site like google.com. If it returns an error, the issue is connectivity-based.

Restart Services: A simple reboot of the Kerio Control appliance or a manual restart of the winroute service via SSH often restores functionality if the issue was a temporary timeout. If you'd like, I can:

Provide the exact SSH commands to check your categorization logs. Help you re-register your license if it shows as expired.

Guide you through setting up DNS forwarding for the zvelo servers.

Web Filter categorization disabled. Serial number: ko-197974

The error "Kerio Control Web Filter is not activated" typically occurs when the firewall loses communication with its categorization servers (Zvelo), or if the special module license has lapsed. Common Fixes Check Licensing:

The Web Filter is a separate paid module. In the WebAdmin, go to Dashboard > License Details to ensure "Kerio Control Web Filter" is still active.

If it’s a new installation, it behaves as a trial for 30 days before automatically disabling. Verify DNS Servers:

The filter relies on DNS queries to categorization servers. If these queries time out 10 times in a row, the filter will auto-disable for reliability.

Recommendation: Use stable public DNS servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) for your custom DNS forwarding.

Reset Reliability Detection (Advanced):If categorization remains disabled despite a good connection, you can force-reset it via the SSH console: Connect via SSH. Run: cd /opt/kerio/winroute

Run: ./tinydbclient "update SiteFilter set DetectReliability=0" Run: /etc/boxinit.d/60winroute restart

Re-Enable in Settings:Navigate to Content Filter > Applications and Web Categories and ensure "Enable Kerio Control Web Filter" is checked. Why This Happens

Authorization Failures: Using an expired Zvelo token (usually expires after 21 days).

ISP/Network Issues: If the firewall cannot reach v4.url.zvelo.com due to slow internet or ISP blocks, it marks the service as unreliable.

Guest Networks: By default, Web Filtering is often disabled on guest interfaces.

Are you seeing a specific "Invalid Authorization" error in the logs, or is the checkbox just grayed out? Using Kerio Control Web Filter

The error message "Kerio Control Web Filter is not activated, categorization is disabled"

typically occurs when the Kerio Control firewall fails to reach the external categorization servers (zvelo) for 10 consecutive attempts within one minute

. This triggers a "not reliable" status, causing the web filter to disable itself to prevent blocking legitimate traffic due to a lack of data. support.keriocontrol.gfi.com Direct Solutions Wait for Automatic Reversion

: In many cases, Kerio Control will automatically attempt to revert to normal operation after if the connection is restored. SSH Fix (Manual Reset)

: If the filter remains disabled, you can manually reset the detection status via the SSH console: Login to the Kerio Control console via Navigate to the directory: cd /opt/kerio/winroute Run the command: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart Adjust DNS Settings

: This error often stems from DNS issues or expired authorization tokens. It is recommended to use Cloudflare (1.1.1.1) (208.67.222.222) as custom DNS servers for the *.zvelo.com domain to ensure reliable categorization traffic. support.keriocontrol.gfi.com Potential Root Causes License Expiration

: The Web Filter requires a special license. If the license has expired or the trial period (30 days) has ended, the categorization options will be unavailable. Connectivity Failures

: High latency or a slow internet link can prevent the system from reaching the update servers. Expired Authorization Tokens

: Zvelo key tokens expire every 21 days; if they fail to refresh from Kerio's internal servers, authorization will fail. support.keriocontrol.gfi.com Checking Filter Status

To verify if the filter is correctly enabled once connectivity is restored: Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter is checked. to save changes. GFI Support SSH commands

for a different version of Kerio Control, or help checking your license status in the GFI portal? Technical Support Specialist Systems Administrator Using Kerio Control Web Filter

It looks like you’re encountering an issue where Kerio Control’s web filter is not activated and categorization is disabled, preventing content filtering from working properly.

Here’s a concise troubleshooting guide to resolve this:

Step 2: Check Internet Connectivity

Kerio Control needs to "phone home" to the categorization servers (typically webfilter.kerio.com or similar endpoints) to download category lists.

  1. Go to Status > Interfaces.
  2. Ensure the WAN interface is online and connected.
  3. Open a command prompt (or the built-in terminal if available via SSH) and attempt to ping a public domain: ping google.com
  4. If DNS is failing, the categorization service will fail. Ensure your DNS settings in Configuration > DNS are correct (try using Google DNS 8.8.8.8 or Cloudflare 1.1.1.1 if the ISP DNS is unresponsive).

5. Check DNS & Connectivity

Primary Causes of the “Categorization Is Disabled” Error

| Cause | Description | |-------|-------------| | 1. No valid license | Web filtering requires an active, non-expired license. | | 2. Disabled categorization engine | The feature is toggled off in configuration. | | 3. DNS resolution failure | The appliance cannot resolve categorization server hostnames. | | 4. Firewall rules blocking the appliance | Outbound HTTPS (port 443) to GFI/McAfee servers is blocked. | | 5. Proxy configuration missing | Kerio Control needs upstream proxy settings to reach cloud servers. | | 6. Time/date mismatch | SSL certificate validation fails if system time is incorrect. | | 7. Corrupted local cache or database | Stale categorization data prevents reinitialization. |

Troubleshooting Kerio Control: Why Your Web Filter Shows "Categorization Disabled"

By [Your Name/Tech Team]

One of the most powerful features of Kerio Control is its ability to filter web content, blocking malicious sites and restricting categories like gambling, adult content, or social media. However, administrators occasionally encounter a frustrating scenario: the Web Filter status displays "Not Activated" or warns that "Categorization is Disabled."

When this happens, your firewall rules relying on URL categories cease to function, leaving the network vulnerable or unfiltered.

This article explores the root causes of this error and provides a step-by-step guide to getting your web categorization back online.

4. Backup the Configuration

After fixing the issue, back up your configuration immediately: