topic Re: URL Filtering Process Order in General Topics

URL Filtering Process Order

migration — Mon, 03 May 2010 21:46:36 GMT

we've run some tests on both at client side and in our office lab.

the process for handling url fitlering will start with BLOCK list --> ALLOW list --> URL Category

the logic of it is quite understandable, however, the problem lies with BrightCloud DB. Is it good enough to filter out all the web sites if we were going to "block" all web surfings. If not, using wildcard at BLOCK list will be the best idea, but will this also create problems from those applications that requires "web-browsing" to be allow??

Re: URL Filtering Process Order

nrice — Tue, 04 May 2010 00:27:57 GMT

Best practice would be to filter based on Bright Cloud categories overall and then use the Block/allow filters for exceptions to those categories - not to handle the brunt of blocking for your web traffic. You can add web-browsing to the application allow list for those applications that are dependant on web-browsing.

Re: URL Filtering Process Order

migration — Tue, 04 May 2010 16:42:40 GMT

another extend to this question would be also be related to if user did not purchase URL filtering license. How is it possible to block the web-surfings? ex. MS-UPDATES needs to have web-browsing enabled, but users are not allowed to surf any web sites...and without having the URL filtering enabled, how can it be controlled?

Re: URL Filtering Process Order

nrice — Tue, 04 May 2010 23:25:29 GMT

There wouldn't be a way to block web-browsing for all users and allow an application based on web-browsing for those same users. You'd have to filter based on users who are completely denied web-browsing and those who are allowed web-browsing and ms-updates.

Re: URL Filtering Process Order

nrouten — Wed, 26 May 2010 15:50:22 GMT

This is another example of why DNS names should be allowed directly in security policy

Very simplified/compact example:

1) outbound 10.0.0.0 web-browsing update.microsoft.com allow

2) outbound 10.0.0.0 web-browsing deny logforwardprofile email alert (IPS)

3) inbound vendor.com(dynamic IP) ssh 10.0.0.0 allow

URL Filter = Rule 1 and 2 would be combined allow/deny and logforward is all traffic, not just 'monitored'. Rule 3 is not possible.