The message "Kerio Control Web Filter is not activated; categorization is disabled"
typically indicates that the firewall has lost connection to the external categorization service (Zvelo) or has a licensing/reliability issue support.keriocontrol.gfi.com Primary Causes and Solutions 1. Connection Reliability Detection
Kerio Control periodically checks its connection to update servers via DNS. If these checks fail 10 times in a row within one minute, it marks the Web Filter as "not reliable" and disables categorization. support.keriocontrol.gfi.com The "Wait" Fix
: Functionality often restores itself after one hour of stable connection. The Command Fix
: If it doesn't restore, you can disable the reliability check via SSH using these GFI Support instructions: SSH into your Kerio Control console. Navigate to: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart support.keriocontrol.gfi.com 2. DNS Resolution Issues If Kerio cannot resolve *.zvelo.com or other update URLs, categorization will fail. support.keriocontrol.gfi.com : Set a custom DNS forward for *.zvelo.com to use reliable public servers like Cloudflare 208.67.222.222 ) in the DNS section of the admin interface. support.keriocontrol.gfi.com 3. License and Token Expiration Module License
: The Web Filter requires a specific license. Without it, the module is automatically disabled 30 days after installation. Invalid Authorization
: This often means the Zvelo token (which expires every 21 days) is invalid. Ensure your firewall can reach the Kerio Registration Server to refresh these tokens automatically. GFI Support Verification Steps
To ensure the filter is correctly set up once the activation issue is resolved: Enable the Filter : Navigate to Content Filter Applications and Web Categories and ensure Enable Kerio Control Web Filter is checked. Test a URL
feature in the same tab to see if a website is correctly categorized (e.g., "Social Networks"). Check Rules : Ensure your Content Rules (under Content Filter Content Rules
) are using these categories correctly; if the filter is inactive, these rules will appear greyed out. GFI Support to run those database commands? Using Kerio Control Web Filter
The error "Kerio Control Web Filter is not activated" typically occurs when the firewall loses communication with its categorization servers (Zvelo), or if the special module license has lapsed. Common Fixes Check Licensing:
The Web Filter is a separate paid module. In the WebAdmin, go to Dashboard > License Details to ensure "Kerio Control Web Filter" is still active.
If it’s a new installation, it behaves as a trial for 30 days before automatically disabling. Verify DNS Servers:
The filter relies on DNS queries to categorization servers. If these queries time out 10 times in a row, the filter will auto-disable for reliability.
Recommendation: Use stable public DNS servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) for your custom DNS forwarding.
Reset Reliability Detection (Advanced):If categorization remains disabled despite a good connection, you can force-reset it via the SSH console: Connect via SSH. Run: cd /opt/kerio/winroute
Run: ./tinydbclient "update SiteFilter set DetectReliability=0" Run: /etc/boxinit.d/60winroute restart
Re-Enable in Settings:Navigate to Content Filter > Applications and Web Categories and ensure "Enable Kerio Control Web Filter" is checked. Why This Happens
Authorization Failures: Using an expired Zvelo token (usually expires after 21 days).
ISP/Network Issues: If the firewall cannot reach v4.url.zvelo.com due to slow internet or ISP blocks, it marks the service as unreliable.
Guest Networks: By default, Web Filtering is often disabled on guest interfaces.
Are you seeing a specific "Invalid Authorization" error in the logs, or is the checkbox just grayed out? Using Kerio Control Web Filter
This specific error in Kerio Control typically occurs when the firewall loses its connection to the categorization servers or encounters a DNS timeout
, causing the Web Filter to enter a "not activated" or "disabled" state for safety. support.keriocontrol.gfi.com Why this happens DNS Failures
: Kerio Control sends periodic queries to reach update servers. If it fails 10 times in a row within 1 minute, it disables the filter. Invalid Authorization
: The Zvelo key token may have expired (typically every 21 days) or is blocked by your ISP's DNS. Slow Connectivity
: High latency or slow internet links can prevent the filter from verifying site categories in real-time. support.keriocontrol.gfi.com How to fix it Change DNS Forwarders
Switch your firewall's custom DNS servers to more reliable ones like Cloudflare 208.67.222.222 ) to ensure *.zvelo.com URLs can be resolved. Restart the Kerio Control Engine
A simple restart of the firewall often restores connectivity and resets the failure counters. Disable "Detect Reliability" (via SSH)
If the error persists due to an unstable internet connection, you can force the filter to stay active by disabling its "Reliability" check: Log in to the console via cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart Verify License Activation Ensure your license or Software Maintenance (SWM) The message "Kerio Control Web Filter is not
hasn't expired, as an expired license will immediately turn off content filtering functions. support.keriocontrol.gfi.com Do you need the specific SSH login commands or help checking your DNS forwarder settings in the admin interface?
Web Filter categorization disabled. Serial number: ko-197974
This error message typically indicates that the Kerio Control Web Filter cannot communicate with the Zvelo categorization servers, or your license has expired. When this happens, the "Applications and Web Categories" tab often appears grayed out or shows as "not activated".
Below are the most effective ways to restore categorization: 1. Fix DNS & Connection Issues (Most Common)
Kerio Control sends automatic DNS queries to reach update servers. If these fail 10 times in a row, categorization is automatically disabled for reliability.
Change DNS Forwarders: Avoid using internal or ISP DNS for the categorization servers. Go to DNS and set a Custom DNS Forwarding rule for *.zvelo.com to use Cloudflare (1.1.1.1) or Google (8.8.8.8).
Manual Reset (SSH): If categorization stays disabled even after fixing DNS, you can manually reset the reliability timer:
Enable SSH by holding Shift and clicking Status > System Health. Log in via SSH and run:
cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard 2. Verify Your License
The Web Filter is a subscription-based module. If your Kerio Control subscription expires, the filter will automatically disable itself after 30 days.
Check your license status in the GFI Administration Interface.
Ensure your firewall has enough disk space to save the license file; low space can cause loading errors. 3. Check Web Admin Activation Sometimes the feature is simply not toggled on in the UI: Go to Content Filter > Applications and Web Categories. Ensure Enable Kerio Control Web Filter is checked.
On the Content Rules tab, verify that the predefined rule "Kerio Control Web Filter categories and applications" is enabled. Feature Comparison: Troubleshooting Steps Primary Fix DNS Timeout Error logs show "DNS response timeout" Use Cloudflare/OpenDNS for *.zvelo.com Invalid Auth "Invalid authorization" in logs Update to the latest version or reboot to refresh tokens Expired License Options are grayed out Renew GFI subscription
Is your Kerio Control showing an "Invalid Authorization" error specifically, or is it just stuck in a "Disabled" state without further detail? Using Kerio Control Web Filter
The error message "Kerio Control Web Filter is not activated, categorization is disabled"
typically occurs when the Kerio Control firewall fails to reach the external categorization servers (zvelo) for 10 consecutive attempts within one minute
. This triggers a "not reliable" status, causing the web filter to disable itself to prevent blocking legitimate traffic due to a lack of data. support.keriocontrol.gfi.com Direct Solutions Wait for Automatic Reversion
: In many cases, Kerio Control will automatically attempt to revert to normal operation after if the connection is restored. SSH Fix (Manual Reset)
: If the filter remains disabled, you can manually reset the detection status via the SSH console: Login to the Kerio Control console via Navigate to the directory: cd /opt/kerio/winroute Run the command: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart Adjust DNS Settings
: This error often stems from DNS issues or expired authorization tokens. It is recommended to use Cloudflare (1.1.1.1) (208.67.222.222) as custom DNS servers for the *.zvelo.com domain to ensure reliable categorization traffic. support.keriocontrol.gfi.com Potential Root Causes License Expiration
: The Web Filter requires a special license. If the license has expired or the trial period (30 days) has ended, the categorization options will be unavailable. Connectivity Failures
: High latency or a slow internet link can prevent the system from reaching the update servers. Expired Authorization Tokens
: Zvelo key tokens expire every 21 days; if they fail to refresh from Kerio's internal servers, authorization will fail. support.keriocontrol.gfi.com Checking Filter Status
To verify if the filter is correctly enabled once connectivity is restored: Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter is checked. to save changes. GFI Support SSH commands
for a different version of Kerio Control, or help checking your license status in the GFI portal? Technical Support Specialist Systems Administrator Using Kerio Control Web Filter
Troubleshooting Kerio Control: Web Filter Not Activated & Categorization Disabled
When the Kerio Control Web Filter displays a "Not Activated" status and categorization is disabled, your network loses its primary defense against malicious and inappropriate web content. This issue typically stems from licensing lapses, DNS resolution failures, or expired communication tokens with the Zvelo categorization service. Primary Causes for Activation Issues
Understanding why the filter is disabled is the first step toward a fix. Common triggers include:
Trial Period Expiration: The Kerio Control Web Filter is an optional module. If not licensed, it functions as a 30-day trial and automatically disables itself afterward. Leo stared at the blinking green cursor on
DNS Reliability Failures: Kerio Control sends automatic DNS check queries to its update servers. If these fail 10 times in a row within one minute, the system deems the filter unreliable and disables categorization.
Expired Authorization Tokens: Kerio uses Zvelo for website categorization. The security tokens for this service expire every 21 days. If they fail to renew—often due to custom DNS settings—the filter will show as "not activated". Step-by-Step Solutions 1. Verify License and Enable the Filter
Before technical troubleshooting, ensure the module is active in the software interface. Log in to the Kerio Control Administration interface.
Navigate to Content Filter > Applications and Web Categories. Ensure Enable Kerio Control Web Filter is checked.
Click Apply. If the options are greyed out, your license for this specific module may have expired or is not included in your current subscription. 2. Resolve "Invalid Authorization" (Zvelo Tokens)
If you see "Invalid authorization" errors in your logs, the issue is likely with the Zvelo token renewal.
Check DNS Forwarders: It is highly recommended to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for *.zvelo.com URLs.
Manual Reset via SSH: If the token won't refresh, you may need to reset it using the Kerio Control Console. Connect via SSH. Navigate to /opt/kerio/winroute.
Verify the DiaServerUrl value is set to v4.url.zvelo.com in the winroute.cfg file. 3. Disable Reliability Detection
If your Internet connection is slow or your ISP has unstable DNS, Kerio might disable the filter prematurely. You can disable this "safety" check via SSH: Log in to the console via SSH.
Execute the command: ./tinydbclient "update SiteFilter set DetectReliability=0".
Restart the service using: /etc/boxinit.d/60winroute restart. 4. Check for Proxy Conflicts
Note that Application Awareness (which relies on the Web Filter) does not work if a non-transparent proxy server is enabled in Kerio Control. Ensure your Proxy Settings are configured to be transparent if you require full categorization. Testing Your Fix Once you have applied these changes, verify the status: Go to Content Filter > Applications and Web Categories. Use the Test URL tool.
Enter a known URL (e.g., google.com) and verify that a category is returned instead of an error.
For further detailed instructions, refer to the GFI Kerio Control Support Guide. Using Kerio Control Web Filter - KerioControl - GFI
Leo stared at the blinking green cursor on his terminal, the words "Kerio Control: Web Filter not activated. Categorization is disabled." burning like a warning flare.
He was the sysadmin at a small, progressive high school, "The Horizon Academy." The school board had just approved a "responsible digital citizenship" curriculum, which meant Leo was supposed to disable the old, draconian web filter. Their theory: teach kids to self-regulate, not just block them. Leo’s job was to make the network functional but unfiltered.
But the Kerio Control box was ancient, a cranky little server that had been patched, rebooted, and cursed at for five years. When Leo clicked "Save" on the new, filter-less policy, the system didn't just turn off protection—it threw an error. Specifically:
"Kerio Control: Web Filter not activated. Categorization is disabled."
Leo shrugged. That was the goal, right?
He was wrong.
Monday, 8:15 AM
The first wave was innocent. A freshman in Ms. Albright’s history class searched for "Roman Empire engineering." Without categorization, the filter didn't know if this was "Education" or "Weapons." The system defaulted to a limbo state—it let everything through, but it also forgot how to cache or prioritize.
The student’s query hit the main server, then bounced to an ad network, then to a CDN in Moldova, then back. The round trip took 14 seconds. Ms. Albright’s smartboard froze, displaying a spinning wheel of death over a pixelated image of a Roman aqueduct.
Tuesday, 10:20 AM
Mr. Henderson in the library noticed it next. Students researching "endangered species" were being served ads for exotic leather boots. Without content categorization, the traffic shaper had no idea what was payload and what was noise. The school’s 500 Mbps pipe was suddenly acting like DSL.
"Why is YouTube buffering?" a student whined.
"It's not YouTube," Leo muttered, pulling up Kerio’s raw logs. The logs were a screaming kaleidoscope of IP addresses: 45% legitimate school traffic, 55% botnets, cryptominers, and zombie click-farms that had slipped in because no filter was there to blacklist known malicious domains.
Kerio wasn't just a wall; it was a traffic cop. And the cop had gone home. Monday, 8:15 AM The first wave was innocent
Wednesday, 1:00 PM – The Boiling Point
The new AI-powered grading platform, "GradeSwift," went down. Every teacher in the building lost their progress reports. The cause? Without bandwidth categorization, a single student’s background torrent client (which he thought he’d closed) opened 8,000 concurrent connections to a seedbox in Luxembourg. Kerio, confused, treated the torrent packets with the same priority as the principal’s Zoom call with the district superintendent.
The call dropped. The superintendent was mid-sentence.
Then came the other problem. Since categorization was disabled, the "safe search" enforcement was also off. A seventh-grader innocently searching for "swim team" was shown results that would make a sailor blush. The filter wasn't blocking bad things; it also wasn't blocking inappropriate things that looked like innocent things.
The principal, Dr. Evans, stormed into Leo's office. "Leo. A parent just called. Their child searched for 'how to build a birdhouse' and got a pop-up for… well, for things you build with birdseed, but not that kind."
Leo stared at the Kerio dashboard. The message was still there, mocking him:
"Web Filter not activated. Categorization is disabled."
He finally understood. "Disabled" didn't mean "open and free." It meant "chaotic and blind." The filter’s absence hadn't created a utopia of self-regulation; it had created a digital jungle where nothing worked right, everything was slow, and the worst stuff rose to the top because there was nothing to push it down.
The Fix
That night, Leo didn't turn the filter back on. Instead, he wrote a 17-line script. It didn't enable categorization. It did something smarter. He set Kerio to a "Log-Only" mode with a custom rule: If categorization is disabled, then throttle all un-categorized traffic to 1kbps and route it to a local cache that updates every 10 seconds.
It was a hack, a Frankenstein solution. But when he hit "Apply," the terminal blinked once.
Status: Web Filter – Custom Policy. Categorization – Bypassed. Work – Resume.
The spinning wheels stopped. The principal’s Zoom reconnected. The torrent client was reduced to a sad, slow trickle. And the seventh-grader’s search for "swim team" now just showed photos of a local pool's schedule.
Leo leaned back. The Kerio box hummed quietly. It wasn't fixed. It was working—despite being broken. And sometimes, that’s the best a sysadmin can hope for.
He printed the error message from Monday and taped it to his monitor. It became his motto: "Not activated. Disabled. But it works."
Because in the end, a good admin doesn't need the filter. He just needs the feeling of the filter—and a really clever script.
It looks like you’re encountering an issue where Kerio Control’s web filter is not activated and categorization is disabled, preventing content filtering from working properly.
Here’s a concise troubleshooting guide to resolve this:
Web Filter → Options.The most common reason for categorization being disabled is a licensing issue. The "Kerio Control Web Filter" (formerly Sophos or integrated categorization) requires an active subscription.
Even if your license shows as valid, the activation token may be corrupted.
Fix:
If your network connects to the internet via a corporate proxy, Kerio Control must be told to use it.
Go to Configuration → Advanced → Proxy Settings or Web Filter → Upstream Proxy (version dependent).
Enter:
Without this, categorization requests will time out.
Use Kerio’s built-in email alerts:
Before contacting support, gather:
Status → Web Filter pageSupport may provide a hotfix or confirm a known bug.