Web Content Filtering
URL Filtering is a nice tool but in most of the cases it is not enough. When more specific needs for advanced filtering are presentContent Filtering can help to better filter the web traffic and secure your network.
Content Filtering allows you to set up access rules based on page content offered by the Syneto Site Categorizing Service.
When filtering by content you also can use more advanced tools like Profiles associated with these categories, custom categories, your networks, active directory groups and time intervals.
To enable and disable the Web Content Filtering (WCF) service go to Web -> Content Filter Settings menu.
Figure 1. Web Content Filter Settings menu
IMPORTANT NOTE:
Before you continue ensure of the following, otherwise the WCF service may not work as you expect:
- HTTP Proxy is enabled
- You have a Filtering Rule in place which lets you use your proxy
- You are not using firewall rules preventing access to the ports the proxy listens on
- The Syneto Appliance has a properly configured gateway
- The Syneto Appliance has a properly configured name server
- The Syneto Appliance has access to the Internet and to the cf.syneto.net server
On the settings page you will find an Enable / Disable button for the service.
Figure 2. Content Filter settings page
There are only a couple of parameters you can set for the WCF service (see Figure 3. below):
- Cache URL categories for – specify the time for how long the categories for URLs will be cached. If you have high network traffic we recommend to set this to a lower value. If you have less web traffic you can set it to a higher value since web page categories rarely change. On the right of this setting you have the option to clear the cache if you wish so.
- The second and last parameter is Always allow files with these extensions – this effectively considers the file with the specified extensions as allowed and the service will not request a category for them and will not try to match these files with any profile or rule. You can think of this parameter as a service-wide whitelist, and we recommend you to include here images, documents and other file types which usually are uncategorized and implicitly allowed.
The last entry on the settings page allows you to do a simply test to ensure that the site categorizing service is working. Just enter any URL and see what is the category for it.
Enabling the WCF service is just the first step in setting up a sophisticated filtering environment. To further refine your access rights you can use Content Filter Profiles associated with network groups and detailed access to different site categories.
To start creating your profiles, go to Web -> Content Filter profiles
Figure 1. Web Content Filter Profiles menu
On the profiles page (Figure 2.) you can observe that a “Default” profile was already created for you. This default profile will alway remain in your list of profiles, it can not be deleted, and all traffic not matching any profile will match the default profile. You can edit the default profile as you would edit any other profile, except you can’t change it’s name and associated networks and groups (see the next section for more details on editing).
To create a new profile click on the “Add profile” button:
Figure 2. The profiles page
A popup will appear where you are asked about the relevant information about a new profile (figure 3).
Figure 3. Adding a new profile
Fill in a name for your profile, this field is mandatory and select some hosts to match the new profile. Don’t bother with the empty “Match these AD groups” column for now, will discuss it later in the Active Directory Integration chapter.
Optionally specify some whitelisted sites as http addresses or as regular expressions.
See figure 4 below for an example on how to fill in the information in a new profile:
After you added your new profile you will be returned to the profiles page where you can see all your profiles and you can delete, edit or define the web access policy for each.
Defining the web access policy for your profile is probably the most important part of the Web Content Filtering configuration. Each profile allows you to select a set of categories you wish to allow or deny to be accessed by the users associated with your profiles.
Click on “web access policy” for a profile in your profile page to access it’s policy details. A details window like the one in Figure 1. below will appear.
Figure 1. Web access policy for a profile
As you can observe the access policy from the Default profile was copied over to your new profile. This will happen for each new profile you create, so you start with an already configured web access policy. Again, having a properly configured Default profile may help you save time and effort in defining your profiles.
On the main part of the screen you have the list of categories containing all main- and sub-categories possible. Checking a category will allow access to it.
Each main category is expandable and it is possible to check (allow) any of it’s sub-categories. Checking a main category will check all it’s sub-categories.
On the top right side of the category region there are options to easily expand and collapse all main categories.
Let’s take a look at the rest of the screen:
- on the top left you have a quick link to go back to the profiles page (don’t forget to click “OK” first to save your changes to the current profile)
- on the left side are the defined time intervals you can associate with profiles (see chapter “ Adding Time Based Rules” for more details about how to use time intervals)
- on the bottom right is a link to your custom categories (see article “Define Custom Categories” for more details)
If all the available categories and sub-categories are not enough, you can further refine your category filters by using “Custom Categories”.
When you first click on “Custom Categories” on the web access policy page and you never defined a custom category, you will be greeted with a proper message.
Figure 1. No custom categories defined, yet.
At this point you can directly click on the “Category based filter” link in the pop-up to go to the “Custom Categories” page, or you can just select the Web -> Content Filter Settings menu and select the last tab called “Custom Categories”.
Figure 2. Custom Categories tab with no categories defined.
Let’s start with defining some custom categories. Click on the “Add category” button and fill in the required information.
Figure 3. New category details
After creating your custom profiles they will appear in the Custom Categories page.
Figure 4. Review the list with the newly created categories
Now, let’s go back to our profile and start using these custom categories.
Figure 5. Associate custom categories with profiles
As you can see each custom category has 3 states:
- don’t use - the custom category will not be used in the current profile’s filtering rules
- allow - the custom category will be allowed for the current profile
- deny - the custom category will be denied for the current profile
Any newly created custom category will be in “don’t use” state by default and you can specify whichever state you want for each of your profiles.
Figure 6. Observer the 3 possible state of a custom category