Kerio Control Web Filter Is Not Activated Categorization Is Disabled Work [2025]
This specific error in Kerio Control typically occurs when the firewall loses its connection to the categorization servers or encounters a DNS timeout
, causing the Web Filter to enter a "not activated" or "disabled" state for safety. support.keriocontrol.gfi.com Why this happens DNS Failures
: Kerio Control sends periodic queries to reach update servers. If it fails 10 times in a row within 1 minute, it disables the filter. Invalid Authorization
: The Zvelo key token may have expired (typically every 21 days) or is blocked by your ISP's DNS. Slow Connectivity
: High latency or slow internet links can prevent the filter from verifying site categories in real-time. support.keriocontrol.gfi.com How to fix it Change DNS Forwarders
Switch your firewall's custom DNS servers to more reliable ones like Cloudflare 208.67.222.222 ) to ensure *.zvelo.com URLs can be resolved. Restart the Kerio Control Engine
A simple restart of the firewall often restores connectivity and resets the failure counters. Disable "Detect Reliability" (via SSH)
If the error persists due to an unstable internet connection, you can force the filter to stay active by disabling its "Reliability" check: Log in to the console via cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart Verify License Activation Ensure your license or Software Maintenance (SWM)
hasn't expired, as an expired license will immediately turn off content filtering functions. support.keriocontrol.gfi.com Do you need the specific SSH login commands or help checking your DNS forwarder settings in the admin interface? This specific error in Kerio Control typically occurs
Web Filter categorization disabled. Serial number: ko-197974
The message "Kerio Control Web Filter is not activated; categorization is disabled"
typically indicates that the firewall has lost connection to the external categorization service (Zvelo) or has a licensing/reliability issue support.keriocontrol.gfi.com Primary Causes and Solutions 1. Connection Reliability Detection
Kerio Control periodically checks its connection to update servers via DNS. If these checks fail 10 times in a row within one minute, it marks the Web Filter as "not reliable" and disables categorization. support.keriocontrol.gfi.com The "Wait" Fix
: Functionality often restores itself after one hour of stable connection. The Command Fix
: If it doesn't restore, you can disable the reliability check via SSH using these GFI Support instructions: SSH into your Kerio Control console. Navigate to: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart support.keriocontrol.gfi.com 2. DNS Resolution Issues If Kerio cannot resolve *.zvelo.com or other update URLs, categorization will fail. support.keriocontrol.gfi.com : Set a custom DNS forward for *.zvelo.com to use reliable public servers like Cloudflare 208.67.222.222 ) in the DNS section of the admin interface. support.keriocontrol.gfi.com 3. License and Token Expiration Module License
: The Web Filter requires a specific license. Without it, the module is automatically disabled 30 days after installation. Invalid Authorization
: This often means the Zvelo token (which expires every 21 days) is invalid. Ensure your firewall can reach the Kerio Registration Server to refresh these tokens automatically. GFI Support Verification Steps Step-by-Step Resolution Summary of Steps to Resolve
To ensure the filter is correctly set up once the activation issue is resolved: Enable the Filter : Navigate to Content Filter Applications and Web Categories and ensure Enable Kerio Control Web Filter is checked. Test a URL
feature in the same tab to see if a website is correctly categorized (e.g., "Social Networks"). Check Rules : Ensure your Content Rules (under Content Filter Content Rules
) are using these categories correctly; if the filter is inactive, these rules will appear greyed out. GFI Support to run those database commands? Using Kerio Control Web Filter
It looks like you’re encountering an issue where Kerio Control’s web filter is not activated and categorization is disabled, preventing content filtering from working properly.
Here’s a concise troubleshooting guide to resolve this:
Step-by-Step Resolution
Summary of Steps to Resolve
- Verify License: Ensure your Web Filter license is active.
- Enable Feature: Go to Content Filter > Web Filter and ensure the main switch is ON.
- Restart Appliance: Reboot the Kerio Control firewall to restart the background categorization engine.
If these steps do not resolve the issue, check the System Logs (Logs > System) for specific error messages regarding the "Categorization engine" or "Update failure."
The error "Kerio Control Web Filter is not activated / categorization is disabled"
typically occurs when the system cannot verify the reliability of its categorization service or if the required license has expired Common Causes & Solutions License Expiry Kerio Control Web Filter is an optional module that requires a special license. If you are in a trial period Verify License: Ensure your Web Filter license is active
, the module is automatically disabled after 30 days, making categorization options unavailable. : Verify your license status on the Kerio Control Dashboard Reliability Detection Failure
: Kerio Control sends automatic DNS check queries to its update servers. If it fails to receive a response 10 times in a row within one minute, it marks the Web Filter as "not reliable" and disables categorization. Temporary Fix
: The system usually attempts to revert to normal operation after one hour. Manual Fix (via SSH)
: You can disable the reliability check manually by logging into the Kerio Control console and running these commands: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard DNS & Connection Issues
: Categorization is handled by an external service (Zvelo). If your DNS settings (like using Google's DNS) interfere with reaching *.zvelo.com , the filter may fail. Cloudflare (1.1.1.1) as custom DNS forwarding servers GFI Support How to Re-enable the Web Filter
If the license and connection are valid, ensure the setting is actually checked in the UI: Kerio Control Administration interface Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter GFI Support SSH commands to check your current license status or verify Zvelo server connectivity Using Kerio Control Web Filter - KerioControl - GFI
3. Test Categorization Status
- Go to Status → Web Filter.
- Look for “Categorization status: OK” or similar.
- If it shows “Disabled” or “Not activated”, the filter won’t work.
Resolution 1: Fix DNS and Connectivity to GFI Cloud
The Kerio appliance must resolve sessions.gfi.com and licensing.gfi.com.
How to test:
- SSH into your Kerio Control server (or use the local console).
- Run:
nslookup licensing.gfi.com - If it fails, your DNS settings in Configuration > Network > DNS are wrong. Set them to
8.8.8.8and1.1.1.1temporarily.
Test HTTPS connectivity:
curl -I https://licensing.gfi.com
- Expected response:
HTTP/1.1 200 OK - If you get a timeout, your upstream firewall or ISP is blocking outbound port 443 to GFI.