URL Filtering when Users are in Multiple Groups?

[dfeddersen]

I am unsure of how to solve this issue with URL filtering.  Lets say HR wants to block the job search category and the hacking category except for specific users.  I have an Active Directory group to allow Job Search for people who are allowed to access those sites, and another AD group for IT people who are allowed to access the Hacking group.

My problem is the people who fall into both groups - they are allowed Hacking and Job Search because they are in both AD groups.

If I use a URL Filtering Security Profile, the the "Allow Job Search" rule (which has Hacking blockecd) hits first, and the user is blocked, even though they are also allowed to access Hacking sites, which the rule below that allows.

If I use the "Service/URL Category" option in the firewall rule instead, it works, but then it does not log the information in the URL Filtering log.  HR wants to be able to have logs for all sites allowed or blocked, so we have "alert" set.

Is there any way to handle providing access to people who happen to be in multiple groups, and also be able to log their browsing history?

Thank you.

[pankaku]

Try this might work. Keep the service/url categroy and add one url filtering profile with alert for the required category.

For example 

Service/URL Category call  Hacking 

profiles ==> call a url filtering profile with hacking as alert and rest of the category can be blocked/allow/alert

[reaper]

for such cases you are also able to set a category as a destination, rather than part of a url filtering profile:

this way you can have a policy explicitly for destination category hacking and one for job searches and then lastly, one for all destinations with a regular url filtering profile

[dfeddersen]

pankaj.kumar,

I will try what you suggested.  Thank you for the idea.

reaper, while your suggestion will allow the appropriate categories, nothing will be logged in the URL filtering log.  We have a HR requirement to log all web browsing history, even if it is allowed.

Thank You.

[reaper]

you can still add a URL filtering profile with 'alert' set to the appropriate url categories for url logging purposes

so you would need to use the category both in destination and url filtering profile

that way you restrict tcp access by means of the category and then simply log the url through security profile

hope this helps

[OtakarKlier]

Hello,

I have also ran into this issue in the past, what we came up with was multiple policies and AD groups. Then a compensating rule that a user account can only be part of one URL filtering group. We made sure we didnt go wild with this and slected the catagories that made sense. I think we only ended up with like 6 policies. It obiviously depends on how you want to break it down.

Cheers!