To resolve the issue where the Kerio Control Web Filter is reported as not activated and categorization is disabled, you typically need to address underlying DNS or authorization issues. This error often occurs when the firewall cannot reach the Zvelo categorization servers. Immediate Fixes
Restart Kerio Control: In many cases, a simple reboot restores connectivity and reactivates the filter automatically.
Manual Activation: Ensure the filter is checked in the administration interface under Content Filter > Applications and Web Categories. Troubleshooting DNS and Authorization
The "categorization disabled" state is often a reliability safety measure triggered after multiple failed DNS queries. Configure Custom DNS Forwarding: Go to DNS in the admin interface. Enable custom DNS forwarding for *.zvelo.com.
Set the DNS servers to Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222), as Google's DNS can sometimes cause authorization token issues.
Check for Expired Tokens: Zvelo key tokens expire every 21 days. If your firewall has been offline or has incorrect time settings, it may fail to update this token. Advanced CLI Solution (If Reliability Check is Stuck) To resolve the issue where the Kerio Control
If the filter remains disabled after a restart, you can manually reset the reliability detection via SSH: Login to the console via SSH. Navigate to the directory: cd /opt/kerio/winroute.
Run the following command to disable the reliability check:./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart.
Note: If your 30-day trial has expired, these options will be greyed out and unavailable until a valid license is applied.
Web Filter categorization disabled. Serial number: ko-197974
“Kerio Control Web Filter is not activated. Categorization is disabled.” What is Kerio Control Web Filter
Kerio Control includes a cloud-based or locally cached URL categorization database. Unlike simple domain blacklists, the Web Filter evaluates the content category of a requested URL (e.g., facebook.com → "Social Networking"). Firewall rules can then allow or deny traffic based on these categories.
If the local database is corrupted, the service may start but categorization remains disabled.
Method 1: Via Web Interface (if option exists in your version) Go to Configuration → Web Filter → Update → Clear Cache or Reset Database.
Method 2: Manual (SSH/Console) Stop the filtering service: streaming). This typically happens because:
/etc/init.d/kerio-filtering stop
Remove the cache directory:
rm -rf /var/kerio/kerio-control/cache/urlfilter/
Restart the service:
/etc/init.d/kerio-filtering start
The service will re-download category data from GFI (may take 5–15 minutes).
When you see “Web filter is not activated” or “Categorization is disabled” in Kerio Control (now GFI Kerio Control), it means the URL filtering feature cannot check websites against its cloud-based category database. Without categorization, the firewall cannot block or allow sites based on content type (e.g., social media, adult content, streaming).
This typically happens because:
licensing.kerio.com or webfilter.kerio.com fails.To resolve the issue where the Kerio Control Web Filter is reported as not activated and categorization is disabled, you typically need to address underlying DNS or authorization issues. This error often occurs when the firewall cannot reach the Zvelo categorization servers. Immediate Fixes
Restart Kerio Control: In many cases, a simple reboot restores connectivity and reactivates the filter automatically.
Manual Activation: Ensure the filter is checked in the administration interface under Content Filter > Applications and Web Categories. Troubleshooting DNS and Authorization
The "categorization disabled" state is often a reliability safety measure triggered after multiple failed DNS queries. Configure Custom DNS Forwarding: Go to DNS in the admin interface. Enable custom DNS forwarding for *.zvelo.com.
Set the DNS servers to Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222), as Google's DNS can sometimes cause authorization token issues.
Check for Expired Tokens: Zvelo key tokens expire every 21 days. If your firewall has been offline or has incorrect time settings, it may fail to update this token. Advanced CLI Solution (If Reliability Check is Stuck)
If the filter remains disabled after a restart, you can manually reset the reliability detection via SSH: Login to the console via SSH. Navigate to the directory: cd /opt/kerio/winroute.
Run the following command to disable the reliability check:./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart.
Note: If your 30-day trial has expired, these options will be greyed out and unavailable until a valid license is applied.
Web Filter categorization disabled. Serial number: ko-197974
“Kerio Control Web Filter is not activated. Categorization is disabled.”
Kerio Control includes a cloud-based or locally cached URL categorization database. Unlike simple domain blacklists, the Web Filter evaluates the content category of a requested URL (e.g., facebook.com → "Social Networking"). Firewall rules can then allow or deny traffic based on these categories.
If the local database is corrupted, the service may start but categorization remains disabled.
Method 1: Via Web Interface (if option exists in your version) Go to Configuration → Web Filter → Update → Clear Cache or Reset Database.
Method 2: Manual (SSH/Console) Stop the filtering service:
/etc/init.d/kerio-filtering stop
Remove the cache directory:
rm -rf /var/kerio/kerio-control/cache/urlfilter/
Restart the service:
/etc/init.d/kerio-filtering start
The service will re-download category data from GFI (may take 5–15 minutes).
When you see “Web filter is not activated” or “Categorization is disabled” in Kerio Control (now GFI Kerio Control), it means the URL filtering feature cannot check websites against its cloud-based category database. Without categorization, the firewall cannot block or allow sites based on content type (e.g., social media, adult content, streaming).
This typically happens because:
licensing.kerio.com or webfilter.kerio.com fails.