Kerio Control Web Filter Is Not Activated Categorization Is Disabled Work Guide
Leo stared at the blinking green cursor on his terminal, the words "Kerio Control: Web Filter not activated. Categorization is disabled." burning like a warning flare.
He was the sysadmin at a small, progressive high school, "The Horizon Academy." The school board had just approved a "responsible digital citizenship" curriculum, which meant Leo was supposed to disable the old, draconian web filter. Their theory: teach kids to self-regulate, not just block them. Leo’s job was to make the network functional but unfiltered.
But the Kerio Control box was ancient, a cranky little server that had been patched, rebooted, and cursed at for five years. When Leo clicked "Save" on the new, filter-less policy, the system didn't just turn off protection—it threw an error. Specifically:
"Kerio Control: Web Filter not activated. Categorization is disabled."
Leo shrugged. That was the goal, right?
He was wrong.
Monday, 8:15 AM
The first wave was innocent. A freshman in Ms. Albright’s history class searched for "Roman Empire engineering." Without categorization, the filter didn't know if this was "Education" or "Weapons." The system defaulted to a limbo state—it let everything through, but it also forgot how to cache or prioritize.
The student’s query hit the main server, then bounced to an ad network, then to a CDN in Moldova, then back. The round trip took 14 seconds. Ms. Albright’s smartboard froze, displaying a spinning wheel of death over a pixelated image of a Roman aqueduct.
Tuesday, 10:20 AM
Mr. Henderson in the library noticed it next. Students researching "endangered species" were being served ads for exotic leather boots. Without content categorization, the traffic shaper had no idea what was payload and what was noise. The school’s 500 Mbps pipe was suddenly acting like DSL.
"Why is YouTube buffering?" a student whined.
"It's not YouTube," Leo muttered, pulling up Kerio’s raw logs. The logs were a screaming kaleidoscope of IP addresses: 45% legitimate school traffic, 55% botnets, cryptominers, and zombie click-farms that had slipped in because no filter was there to blacklist known malicious domains.
Kerio wasn't just a wall; it was a traffic cop. And the cop had gone home.
Wednesday, 1:00 PM – The Boiling Point
The new AI-powered grading platform, "GradeSwift," went down. Every teacher in the building lost their progress reports. The cause? Without bandwidth categorization, a single student’s background torrent client (which he thought he’d closed) opened 8,000 concurrent connections to a seedbox in Luxembourg. Kerio, confused, treated the torrent packets with the same priority as the principal’s Zoom call with the district superintendent.
The call dropped. The superintendent was mid-sentence. Leo stared at the blinking green cursor on
Then came the other problem. Since categorization was disabled, the "safe search" enforcement was also off. A seventh-grader innocently searching for "swim team" was shown results that would make a sailor blush. The filter wasn't blocking bad things; it also wasn't blocking inappropriate things that looked like innocent things.
The principal, Dr. Evans, stormed into Leo's office. "Leo. A parent just called. Their child searched for 'how to build a birdhouse' and got a pop-up for… well, for things you build with birdseed, but not that kind."
Leo stared at the Kerio dashboard. The message was still there, mocking him:
"Web Filter not activated. Categorization is disabled."
He finally understood. "Disabled" didn't mean "open and free." It meant "chaotic and blind." The filter’s absence hadn't created a utopia of self-regulation; it had created a digital jungle where nothing worked right, everything was slow, and the worst stuff rose to the top because there was nothing to push it down.
The Fix
That night, Leo didn't turn the filter back on. Instead, he wrote a 17-line script. It didn't enable categorization. It did something smarter. He set Kerio to a "Log-Only" mode with a custom rule: If categorization is disabled, then throttle all un-categorized traffic to 1kbps and route it to a local cache that updates every 10 seconds.
It was a hack, a Frankenstein solution. But when he hit "Apply," the terminal blinked once.
Status: Web Filter – Custom Policy. Categorization – Bypassed. Work – Resume.
The spinning wheels stopped. The principal’s Zoom reconnected. The torrent client was reduced to a sad, slow trickle. And the seventh-grader’s search for "swim team" now just showed photos of a local pool's schedule.
Leo leaned back. The Kerio box hummed quietly. It wasn't fixed. It was working—despite being broken. And sometimes, that’s the best a sysadmin can hope for.
He printed the error message from Monday and taped it to his monitor. It became his motto: "Not activated. Disabled. But it works."
Because in the end, a good admin doesn't need the filter. He just needs the feeling of the filter—and a really clever script.
The error message "Kerio Control Web Filter is not activated, categorization is disabled"
typically occurs when the Kerio Control firewall fails to reach the external categorization servers (zvelo) for 10 consecutive attempts within one minute
. This triggers a "not reliable" status, causing the web filter to disable itself to prevent blocking legitimate traffic due to a lack of data. support.keriocontrol.gfi.com Direct Solutions Wait for Automatic Reversion Monday, 8:15 AM The first wave was innocent
: In many cases, Kerio Control will automatically attempt to revert to normal operation after if the connection is restored. SSH Fix (Manual Reset)
: If the filter remains disabled, you can manually reset the detection status via the SSH console: Login to the Kerio Control console via Navigate to the directory: cd /opt/kerio/winroute Run the command: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart Adjust DNS Settings
: This error often stems from DNS issues or expired authorization tokens. It is recommended to use Cloudflare (1.1.1.1) (208.67.222.222) as custom DNS servers for the *.zvelo.com domain to ensure reliable categorization traffic. support.keriocontrol.gfi.com Potential Root Causes License Expiration
: The Web Filter requires a special license. If the license has expired or the trial period (30 days) has ended, the categorization options will be unavailable. Connectivity Failures
: High latency or a slow internet link can prevent the system from reaching the update servers. Expired Authorization Tokens
: Zvelo key tokens expire every 21 days; if they fail to refresh from Kerio's internal servers, authorization will fail. support.keriocontrol.gfi.com Checking Filter Status
To verify if the filter is correctly enabled once connectivity is restored: Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter is checked. to save changes. GFI Support SSH commands
for a different version of Kerio Control, or help checking your license status in the GFI portal? Technical Support Specialist Systems Administrator Using Kerio Control Web Filter
When Kerio Control displays the error "Web Filter is not activated" or "categorization is disabled," it typically indicates a breakdown in communication between your firewall and the zvelo categorization servers or an expired license component. This effectively disables category-based filtering rules, leaving your network exposed. Primary Causes and Solutions
DNS Reliability Check Failures: Kerio Control performs automated DNS checks to verify connectivity to update servers. If these queries fail 10 times consecutively within one minute, the system marks the Web Filter as "unreliable" and disables it.
Fix: You can disable this "Reliability detection" via the SSH console by navigating to /opt/kerio/winroute and executing:./tinydbclient "update SiteFilter set DetectReliability=0".
DNS Forwarding Issues: Using certain DNS providers (like Google's 8.8.8.8) can occasionally cause categorization failures.
Recommendation: Use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers specifically for *.zvelo.com domains.
Expired Authorization Tokens: Categorization relies on a security token that expires every 21 days. If your firewall cannot reach the internal GFI/Kerio servers to refresh this token, categorization will stop working.
Licensing Constraints: The Kerio Control Web Filter is a separate licensed module. If your main license does not include this add-on, or if you are 30 days past installation without a valid key, the feature will be automatically disabled. Immediate Troubleshooting Steps
Check License Status: In the Kerio Control Webadmin Dashboard, verify that the "Kerio Control Web Filter" component shows as active and has not exceeded its download limits. the filter won’t work.
Verify Configuration: Ensure the filter is explicitly enabled under Content Filter > Applications and Web Categories.
Perform a Test URL: Use the "Test URL" tool in the administration interface to see if the firewall can successfully categorize a site like google.com. If it returns an error, the issue is connectivity-based.
Restart Services: A simple reboot of the Kerio Control appliance or a manual restart of the winroute service via SSH often restores functionality if the issue was a temporary timeout. If you'd like, I can:
Provide the exact SSH commands to check your categorization logs. Help you re-register your license if it shows as expired.
Guide you through setting up DNS forwarding for the zvelo servers.
Web Filter categorization disabled. Serial number: ko-197974
4. Backup the Configuration
After fixing the issue, back up your configuration immediately:
- Status > Configuration Backup > Export
.cfgfile. - In a disaster, you can restore this file, but do not restore an old backup that contained the "categorization disabled" state.
Resolution 5: The "Transparent Proxy" Loop Issue (Advanced)
A known edge case: If you have configured Kerio Control to act as a transparent proxy on the LAN interface, and also have a firewall rule that forces all traffic from the firewall itself to go through that proxy, it creates a loop. The firewall cannot phone home to GFI because its own traffic is being filtered.
Fix:
- Create an exclusion rule.
- Go to Configuration > Traffic Rules.
- Add a rule at the top: Source: Firewall (Local Host) / Destination: GFI IP ranges / Service: HTTPS / Action: Allow (Bypass web filter).
Option C: Contact GFI/Kerio Support
Before contacting support, gather:
- Kerio Control version and build number
- Output of
Status → Web Filterpage - Screenshot of license page
- DNS and NTP test results
Support may provide a hotfix or confirm a known bug.
Step 8: Verify Connectivity to Categorization Servers
The following endpoints are used (depending on version). Ensure they are reachable on TCP 443:
categorization.gfi.commcafee.url.cloud.gfi.comapi.mcafee.comdownloads.kerio.com(for license validation)
Use the diagnostic tool: Diagnostics → Ping / Traceroute.
Step 1: Verify the License
The Web Filter is a premium feature. If your license does not include it, or if the license has expired, the categorization engine will shut down.
- Log in to the Kerio Control Administration Console.
- Navigate to Configuration > Licenses.
- Look for the Kerio Control Web Filter entry.
- Does it have a green checkmark?
- Is the status "Active"?
- Does the license capacity cover the number of users on your network?
If the license is missing or invalid, you must upload a new license file or contact your vendor.
Step-by-Step Resolution
Follow these steps to resolve the "Categorization is Disabled" status.
3. Test Categorization Status
- Go to Status → Web Filter.
- Look for “Categorization status: OK” or similar.
- If it shows “Disabled” or “Not activated”, the filter won’t work.