This article addresses the common "Kerio Control Web Filter is not activated; categorization is disabled" error. This issue typically prevents the firewall from effectively blocking or allowing websites based on their category, leaving your network vulnerable or causing connectivity disruptions. Understanding the Error
The "categorization is disabled" status occurs when the Kerio Control engine cannot verify its license or communicate with the backend categorization service, which is powered by Zvelo. This results in the filter failing to identify the nature of web traffic (e.g., social media, gambling, malware), often defaulting to a "not activated" state. Phase 1: Troubleshooting License and Activation
Before diving into technical commands, ensure the software is correctly registered and the license is current.
Verify License Status: Log in to the Kerio Control Administration interface and check the Dashboard. If it shows as "unregistered" or "trial expired," the Web Filter will automatically disable after 30 days.
Renew Key Tokens: The Web Filter uses a Zvelo key token that expires every 21 days. If your firewall hasn't been able to reach the registration servers, this token will lapse.
Manual Registration: If online activation fails, you can download a .key file from the Kerio Product Registration page and import it via Configuration Assistant > Register product > Register offline by license file. Phase 2: Fixing Connectivity and DNS Issues
The Web Filter relies heavily on DNS to communicate with the Zvelo servers. Incorrect DNS settings are a frequent cause of "Invalid Authorization" errors.
Change Custom DNS Forwarders: Using Google DNS (8.8.8.8) can sometimes cause authorization failures with Zvelo URLs. It is recommended to use: Cloudflare: 1.1.1.1 OpenDNS: 208.67.222.222 or 208.67.220.220. This article addresses the common "Kerio Control Web
Check Zvelo Server URL: Through the SSH console, verify that the DiaServerUrl in /opt/kerio/winroute/winroute.cfg is set to v4.url.zvelo.com. Phase 3: Technical Fix via SSH
If the Web Filter remains disabled due to "Reliability detection" (where the firewall stops checking categorization if it thinks the connection is unstable), you can force it to stay active.
Enable SSH: In the administration interface, go to Advanced Options > SSH and enable it.
Connect to Console: Use a client like PuTTY to SSH into your Kerio Control appliance. Execute the Fix:
cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution.
This command disables the feature that shuts down categorization during minor network timeouts, keeping the filter active. Phase 4: Enabling and Testing the Filter
Once the underlying connection or license issue is resolved, you must re-enable the filter: If the service starts but fails to download
Navigate: Go to Content Filter > Applications and Web Categories. Enable: Check the box for Enable Kerio Control Web Filter.
Apply Content Rules: Ensure your Content Rules tab has the predefined rule for "Kerio Control Web Filter categories and applications" enabled.
Test a URL: Use the Test URL tool in the same tab to verify if a site (e.g., facebook.com) is correctly categorized. Summary of Quick Fixes Primary Fix Invalid Authorization Error Switch DNS to Cloudflare (1.1.1.1) and reboot. Trial Expired/Disabled Purchase/import a valid license key. Frequent Timeouts/Disabling Disable "DetectReliability" via SSH command. Categorization Not Active
Ensure "Kerio Control Web Filter" is checked in Content Filter settings.
Here’s a useful, concise fix for the issue: Kerio Control web filter not activating with “categorization is disabled.”
If the service starts but fails to download category data, the local SQLite or Berkeley DB files may be corrupted.
Step-by-step DB reset:
categorization (e.g., mv categorization categorization.bak).categories.db or db/url_categories.db if present.Note: If your internet connection is slow, the status will stay “disabled” until the download completes.
Kerio Control includes web filtering only in paid licenses (Standard, Enterprise, or UTM). The free trial or a basic "Firewall only" license does not include categorization.
Steps:
Important: Some legacy licenses (e.g., Kerio Control 7.x perpetual) do not include the categorization service. You may need to upgrade to a “Content Filtering” add-on.
Ensure you are running the latest version of Kerio Control. Check for updates and install the latest version if necessary.
Kerio Control’s web filter requires a Content Filtering license (part of the Security Pack).
HTTPS inspection can interfere with the web filter’s ability to download categorization data, because the update process uses a pinned certificate that may be tampered with if you’re intercepting all SSL traffic. Delete or rename the folder: categorization (e
/opt/kerio/ctrl/bin/kerio-control-web-filter --uninstall
/opt/kerio/ctrl/bin/kerio-control-web-filter --install
Then re-download categories.