Web. Sophos v16.5

PDF

Dokument

Oglas

Sophos XG Firewall | Protect | 405

Web

Use the web protection settings to identify and block the latest web threats. These settings let you control traffic and protect against threats and inappropriate web usage. Exceptions let you override settings as required for your business needs.

Policies

With policies, you can control traffic using rules and advanced settings. The default set of policies describes some common restrictions.

Figure 374: Policies

Rules

Rules specify the following criteria:

• Users to whom the rule applies. These include groups and individual users.

• Activities that describe the type of usage to restrict. These include user activities, categories, URL groups, file types, and dynamic categories.

• An action to take when the firewall encounters traffic that matches the rule criteria.

The firewall evaluates rules from highest to lowest. For example, a rule that allows all traffic that precedes a rule that restricts a specific type of traffic takes precedence and the subsequent rule is ignored.

Sophos XG Firewall | Protect | 406

Figure 375: Rules

Migrating Policies from Previous Releases

This release supports up to 128 rules in a single policy. If you are migrating policies from a previous release that contain more than 128 rules, only the first 128 rules will be used.

Web policy rules now support combined activities. These include user activities, categories, URL groups, file types, and dynamic categories. To maintain the overall functionality of the policy, replace blocks of adjacent rules for different activities with a single rule that contains a group of activities. Please delete or consolidate rules as required.

Add Policy

1. Go to Protect > Web > Policies and click Add Policy.

2. Type a name.

3. Click Add Rule.

Tip: To use an existing rule as a template, click the Clone button ( ).

The firewall creates a default rule that blocks all web traffic for all users. The default rule is disabled.

Figure 376: Add Rule

4. Specify users.

a) In the new rule, move the pointer over the users field, click on the user, and then click Add New Item.

b) Clear the Anybody check box.

c) Select users.

Sophos XG Firewall | Protect | 407

Tip: You can filter the type of users to display by clicking Show Only and selecting a user type.

d) Click Apply selected items.

Figure 377: Select Users

5. Specify activities.

These include user activities, categories, URL groups, file types, and dynamic categories.

a) Move the pointer over the activities field and click Add New Item.

b) Clear the All Web Traffic check box.

c) Select activities.

Tip: You can filter the type of activities to display by clicking Show Only and selecting an activity type.

d) Click Apply selected items.

6. In the Action field, specify an action to take when the firewall encounters HTTP traffic that matches the selected criteria .

Select from the following options (where permitted by the action type):

Options

Allow Warn Block

7. (Optional) Specify an action to take when the firewall encounters HTTPS traffic that matches the selected criteria.

Note: Follow these steps only if you want to specify an action for HTTPS traffic that is different from the one you specified for HTTP.

a) Move the pointer to the right of the Action list.

The firewall displays the HTTPS Use Action action list.

Figure 378: HTTPS Use Action

b) Select an option.

HTTPS Use Action

Use Action: Select this option to use the same action that is currently in effect for HTTP traffic. If you specify a different HTTP action at a later time, HTTPS action will also use that action. Allow:

Always allow HTTPS traffic that matches the selected criteria. Warn: Always display a warning message when encountering HTTPS traffic that matches the selected criteria. Block: Always block

HTTPS traffic that matches the selected criteria.

8. Move the pointer over the Constraints field and select a schedule.

Tip: You can create a new schedule by clicking Create new and specifying criteria.

Sophos XG Firewall | Protect | 408

9. Click the On/Off switch to enable the rule.

Figure 379: Enable Rule

10. Click and drag the rule handle to position the rule in the hierarchy.

Figure 380: Position Rule

11. Click Advanced Settings and specify settings for the policy.

Enable logging and reporting

Include this policy in logs and reports.

Prevent downloading of large files

Prevent downloading files greater than the size specified.

Restrict login domains for Google Apps

Restrict logging in to Google Apps only on the domains specified.

Enable YouTube for Schools

Restrict YouTube content to videos on

YouTube for Schools

(a limited EDU-only site) and to those uploaded using the ID specified.

Note: You must have a YouTube school ID to use this setting.

Figure 381: Advanced Settings

User Activities

User activities combine web categories, file types, and URL groups in one container. For example, you can create a user activity to associate spyware and malware with a list of URLs. You can include user activities in web policies to control access to websites or files that match any of the specified criteria.

Add User Activity

1. Go to Protect > Web > User Activities and click Add.

2. Type a name.

3. Click Add New Item and select categories.

Sophos XG Firewall | Protect | 409

Select from the following:

• Web categories

• File types

• URL groups

Note: Categories are evaluated using ‘OR’. Only one category must return true in order to match traffic.

Tip: You can filter the type of categories to display by clicking Show: All and selecting a category type.

Figure 382: Add User Activity

URL Groups

URL groups contain one or more URLs that you can use in web policies to block or allow access to websites.

Add URL Group

1. Go to Protect > Web > URL Groups and click Add.

2. Type a name.

Type a URL in the Search/Add text box and click the Add button ( ).

Figure 385: Add URL Group

Exceptions

With exceptions, you can override protection settings for web traffic that matches the specified criteria. For example, you can create an exception to skip HTTPS decryption for sites that contain confidential data. The default set of exceptions specifies some common override behaviors.

Override behaviors now include Sandstorm.

Note: Existing exceptions that skip malware scanning now also skip Sandstorm analysis.

Add Exception

1. Go to Protect > Web > Exceptions and click Add Exception.

2. Type a name.

3. Specify web traffic criteria.

Note: The firewall evaluates all types of criteria specified using the ‘AND’ operator. For example, if you specify URL patterns and website categories, both types must return true in order to match traffic.

However, within each category, criteria are evaluated using ‘OR’.

URL pattern matches

Match web traffic according to the specified URL or pattern, for example, example.com. Regular expressions are allowed here. For example, ^([A-Za-z0-9.-]*\.)?example\.com/ matches all subdomains of example.com.

Note: You must specify pattern matches using ASCII characters. For information about converting non-ASCII characters, refer to

RFC 3490, Internationalizing

Domain Names in Applications

Website categories

Match web traffic according to the specified web categories.

Source IP addresses

Match web traffic that originates from the specified IP addresses.

Destination IP addresses

Match web traffic going to the specified IP addresses.

Sophos XG Firewall | Protect | 412

Figure 386: Add Exception

4. Specify an action to skip when the firewall encounters traffic that matches the criteria.

HTTPS Decryption

Do not decrypt HTTPS for traffic that meets the specified criteria.

Note: If you disable HTTPS decryption, the firewall will not perform any other check that relies on decrypted traffic, such as malware scanning or micro-app detection.

However, the firewall will continue to scan HTTP traffic that matches the exception.

Malware Scanning

Do not scan traffic that meets the specified criteria for malware.

Sandstorm

Do not send files that are downloaded using the specified criteria to Sandstorm for analysis.

Policy Checks

Do not check policies for traffic that meets the specified criteria.

Protection

The firewall provides several methods for protecting against threats and inappropriate web usage. Use these settings to configure how the firewall scans content for malware and to enable other protection features.

Sophos XG Firewall | Protect | 413

Malware Scanning

Configure general restrictions for scanning and restricting traffic by type and protocol.

Scan Engine Selection

Specify the type of scanning to apply.

Note: If you are using Sandstorm, set the single-scan engine to Sophos or select dualengine scanning.

Available Options:

Single Engine: Scan traffic using the primary anti-virus engine (by default, Sophos). This selection offers optimal performance.Dual Engine: Scan traffic using both engines, first by the primary and then by the secondary. Using this setting increases security, but may affect performance.

Malware Scan Mode

Specify batch or real-time scanning for HTTP/HTTPS traffic.

In batch mode, virus scanning will start only after the entire file has been downloaded. While this mode offers maximum protection, it may result in slower performance. Switch to real-time scanning to improve performance.

Content that could not be scanned

Specify an action to take when the firewall encounters content that could not be scanned.

Note: Files that cannot be fully scanned because they are encrypted or corrupted may contain undetected threats. Blocking offers the best protection.

Do not scan files larger than

Specify the maximum size of files to be scanned for HTTP(S), in MB. Files that exceed this setting will not be scanned.

Acceptable range: 1 to 256 MB

Default: 1 MB

Note: If you are using Sandstorm, this value has been reset to the recommended minimum value.

Maximum file scan size for FTP

Specify the maximum size of files to be scanned for FTP, in MB. Files that exceed this setting will not be scanned.

Acceptable range: 1 to 204 MB

Default: 1 MB

Scan audio and video files

Scan audio and video content for malware and threats. Scanning may cause issues with streaming audio and video.

Enable pharming protection

Pharming attacks redirect users from legitimate websites to fraudulent websites that have been created to look like the legitimate site.

Protect users against pharming and other domain name poisoning attacks by repeating DNS lookups before connecting.

Search Engine Enforcement

Enforce SafeSearch

Block websites that contain sexually explicit content from Google, Yahoo, and Bing search results.

Sophos XG Firewall | Protect | 414

Note: This setting is applicable only when the ‘No Explicit Content’ web policy is set to ‘Block’.

Enforce additional image filters

Restrict image search results to images with a Creative Commons license.

HTTPS Decryption and Scanning

HTTPS Scanning Certificate Authority (CA)

Specify the certificate authority for securing scanned HTTPS connections.

Block unrecognized SSL protocols

Prevent traffic that avoids HTTPS scanning by using invalid SSL protocols.

Block invalid certificates

Connect only to sites with a valid certificate.

Advanced

Configure advanced web protection such as caching behavior and proxy settings.

Web Content Caching

Enable web content cache

Keep a copy of frequently visited sites to reduce bandwidth consumption and improve performance.

Always cache Sophos Endpoint updates

Keep a copy of Sophos Endpoint updates to improve performance on your network.

Note: If this option is disabled you may experience network congestion when many endpoints attempt to download updates from the Internet at the same time.

Web Proxy Configuration

The firewall intercepts traffic transparently and enforces web protection (for example, policies and malware scanning) when the web proxy service is enabled for a network zone. By default, the service is enabled for LAN and WiFi zones. In transparent mode, the firewall allows HTTP traffic on port 80 and HTTPS traffic on port 443 only.

However, you can also configure the firewall to act as a proxy for configured web browsers by specifying a web proxy listening port. Users who are behind the proxy must specify the LAN or WiFi address and port in the web proxy configuration settings of their browsers. (Refer to the browser documentation for details.)

Specify the web proxy listening port and allowed destination ports when you want the firewall to act as a web proxy for configured web browsers.

Note: IPS policy is applicable on the traffic between proxy and WAN, but not between user and proxy.

Note: Traffic shaping policy is not applicable on the direct proxy traffic.

Web Proxy Listening Port

Specify the port on which the web proxy will listen for HTTP connection requests.

Allowed Destination Ports

The firewall may receive requests to connect to remote servers using a non-standard port. Specify the ports on which the proxy will allow connection. (This setting applies only when the web proxy listening port is set.)

CAUTION: Allowing connection on non-standard ports may pose a security risk.

Sophos XG Firewall | Protect | 415

File Types

A file type is a classification that is determined by file extension and MIME header. You can include file types in web policies to control access to files that match the specified criteria. The default file types contain some common criteria and you can create additional types.

Using File Types with Policy Rules

You can create file types to control access to files on a more granular level. For example, you may want to allow access to SQL files but deny access to all other database files. In this case, you would create a file type for SQL files and a policy that specifies the following rules in the following order:

1. Allow access to SQL files

2. Block access to all database files

Add File Type

1. Go to Protect > Web > File Type and click Add.

2. Type a name.

3. (Optional) Select a template.

You can select from predefined or custom file types. If you do not wish to use a template, choose Blank.

4. Specify the file extension and MIME header.

Figure 387: Add File Type

Surfing Quotas

Surfing quota policy allows you to assign the duration of Internet surfing time to users and groups.

• Duration of Internet access can be cyclic or non-cyclic.

• You can apply the surfing quota policy to users.

The device is shipped with the following predefined policies. Predefined policies can be applied straight away to users and groups.

• Unlimited Internet Access

• 1 Month Unlimited Access

• 1 Month 100 hours

• Monthly 100 hours Cyclic

Sophos XG Firewall | Protect | 416

• Daily 1 hour Cyclic

• Weekly 7 hours Cyclic

Note:

1. Users generally belong to a group. If the surfing quota policy applied to the user differs from the one applied to the user’s group, the user’s policy takes priority.

2. For details of policies and rules to which the surfing quota policy can be applied, view the following diagram.

Add Surfing Quota

To assign the duration of Internet surfing time to users and groups, you can create surfing quota policies. These policies are then applied to users (Configure > Authentication > Users) and groups (Configure > Authentication >

Groups).

The Add Surfing Quota Policy page allows you to create a surfing quota policy.

Sophos XG Firewall | Protect | 417

1. Go to Protect > Web > Surfing Quotas or System > Profiles > Surfing Quotas and click Add on the upper right side.

Note: Surfing Quota policies can also be created when applying the policy to users or groups from the respective pages. The Surfing Quota page displays the full list of predefined and custom policies.

2. Enter the details.

Name

Enter a unique name to identify the policy.

Description

Enter a description for the surfing quota policy.

Cycle Type

Select the cycle type.

Available Options:Cyclic: Duration of Internet access recurs for each cycle.Non-Cyclic: When the specified time limit ends, the user is disconnected.

Cycle Hours (available only if Cycle Type is Cyclic)

Specify the cycle hours in hours and minutes. Select the cycle from the drop-down list. Cycle hours define the upper limit of surfing hours for daily, weekly, monthly or yearly cycles.

At the end of each cycle, cycle hours are reset to zero.

Example: If cycle hours specified are 7 hours 30 minutes for a daily cycle, they are reset to zero at the end of each day whether cycle hours are fully or partially used or remain unused.

Validity

Select Unlimited if you do not want to restrict the validity period. Clear the check box to specify the validity period of Internet access.

Maximum Hours

Select Unlimited if you do not want to restrict the maximum allowed surfing duration. Clear the check box to specify the maximum duration (in hours and minutes) of surfing time allowed across the validity period.

Example: Cyclic Policy

Cycle Hours: 5 hours per day

Validity: 5 days

Maximum Hours: 20 hours

If the user accesses Internet for 5 hours each day, the user will have used 20 hours of Internet access by the end of the fourth day and hence will be disconnected.

Example: Non-Cyclic Policy

Validity: 10 days

Maximum Hours: 10 hours

The user is disconnected at the end of 10 hours even if the validity period does not expire.