Skip to main content

Kerio Control Web Filter Is Not Activated Categorization Is Disabled Fixed

Before diving into solutions, it helps to understand why this happens. The web filter relies on a few key components:

: Ensure your Kerio Control Web Filter license hasn't expired, as it will automatically disable after 30 days of trial or upon expiration.

In this guide, we will explore and provide a step-by-step troubleshooting sequence to restore full web filtering functionality.

When you see this warning in your (usually under Dashboard or Security logs), it means the system cannot reach the third-party classification services—specifically Zvelo —or the license authorization is failing. Common Symptoms: Users can access websites that should be blocked. Internet connectivity may be intermittent or slow. Before diving into solutions, it helps to understand

The most common cause is a licensing hiccup. Even if you believe your license is valid, the system needs to verify this with the activation servers.

Run this to see if categorization is alive:

How to Fix "Kerio Control Web Filter is Not Activated, Categorization is Disabled" When you see this warning in your (usually

Kerio sends automated check queries to cloud infrastructure. If a response is dropped 10 consecutive times within 1 minute, the firewall marks the backend engine as unreliable and completely disables categorization.

: Using Google DNS (8.8.8.8) can sometimes cause authorization failures with Zvelo URLs. It is recommended to use: Cloudflare : 1.1.1.1 OpenDNS : 208.67.222.222 or 208.67.220.220 .

Ensure there is a rule allowing to Internet for HTTP/HTTPS traffic. The most common cause is a licensing hiccup

to disable the reliability check: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service : /etc/boxinit.d/60winroute restart Solution 2: Resolve "Invalid Authorization" DNS Issues

: Avoid using Google DNS (8.8.8.8) as your primary forwarder for this service. Instead, set Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for the *.zvelo.com domain.

Kerio Control must resolve specific external domains to check licenses and fetch categorization data. If your firewall is using faulty upstream DNS servers, it cannot find the cloud categorization engines. Navigate to > DNS .

Before diving into solutions, it helps to understand why this happens. The web filter relies on a few key components:

: Ensure your Kerio Control Web Filter license hasn't expired, as it will automatically disable after 30 days of trial or upon expiration.

In this guide, we will explore and provide a step-by-step troubleshooting sequence to restore full web filtering functionality.

When you see this warning in your (usually under Dashboard or Security logs), it means the system cannot reach the third-party classification services—specifically Zvelo —or the license authorization is failing. Common Symptoms: Users can access websites that should be blocked. Internet connectivity may be intermittent or slow.

The most common cause is a licensing hiccup. Even if you believe your license is valid, the system needs to verify this with the activation servers.

Run this to see if categorization is alive:

How to Fix "Kerio Control Web Filter is Not Activated, Categorization is Disabled"

Kerio sends automated check queries to cloud infrastructure. If a response is dropped 10 consecutive times within 1 minute, the firewall marks the backend engine as unreliable and completely disables categorization.

: Using Google DNS (8.8.8.8) can sometimes cause authorization failures with Zvelo URLs. It is recommended to use: Cloudflare : 1.1.1.1 OpenDNS : 208.67.222.222 or 208.67.220.220 .

Ensure there is a rule allowing to Internet for HTTP/HTTPS traffic.

to disable the reliability check: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service : /etc/boxinit.d/60winroute restart Solution 2: Resolve "Invalid Authorization" DNS Issues

: Avoid using Google DNS (8.8.8.8) as your primary forwarder for this service. Instead, set Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for the *.zvelo.com domain.

Kerio Control must resolve specific external domains to check licenses and fetch categorization data. If your firewall is using faulty upstream DNS servers, it cannot find the cloud categorization engines. Navigate to > DNS .