How to use Replacement Message Groups on FortiGate firewalls

As you may have seen in previous articles, the Fortigate firewalls have various replacement messages for various functions such as:

• Application Control block
• DLP block
• FortiGuard category block page
• Login
• etc

However, there are use cases where you do not want to show the same replacement messages to all users.  There could be a situation where you have two organizations sharing office space and network resources, City Hall vs Police Department in “City Of’s”, or any number of scenarios.  Fortinet includes a feature known as Replacement Message Groups.  This feature is not available by default so it will need to be enabled via the CLI.

Version 6.2.2

Enabling Replacement Message Groups

To enable the replacement messages groups, you need to head over to the CLI and issue the following command

config system settings
    set gui-replacement-message-groups enable
end

Make sure you type end to save the configuration.

Once you enable the replacement-message group, you will need to log out of the GUI and log back in.  You can now go to System then Replacement Message Groups.  You can now create a new group.

Types of Replacement Message Groups

There are two types of Replacement Message Groups

UTM and Auth each one is used in different locations

The UTM type is assigned to the various Security Profiles while the auth are assigned to the policy such as the login prompt when you have captive portal enabled.

Assigning Replacement Message Group to Security Profile

I created a test Security Profile named MonkeyBusiness-Web to test the replacement message.

As you can see in the screenshot, the MonkeyBusiness replacement message group type is UTM

If I try to edit the Firewall Policy I created ID 57 you can see that there are no replacement-groups shown in the picture below.

Assigning Replacement Message Group to a firewall policy

Now I am going to change the type from utm to auth so that I can assign it to the firewall policy.

Now we will edit firewall policy 57

Now you can see that there is a MonkeyBusiness replacement-group available to assign.

Outcome

This will allow you to have multiple replacement messages for various needs.

Above is the default message

Above is the MonkeyBusiness replacement message.

Hope this helps