Sophos XG Firewall | Protect | 418
Figure 388: Add Surfing Quota Policy
3. Click Save.
User Notifications
The firewall displays notifications to users when a web policy is set to block access or warn before connecting. Use these settings to create and preview notifications.
To specify an image to display on notification pages, enable the Use custom images check box and choose images.
To create a block notification, enable the Use custom block message check box and type a message.
To create a warning notification, enable the Use custom warn message check box and type a message.
You can preview current messages by clicking the preview links.
Applications
This section provides facilities to control and manage the applications shipped with the device.
The following pages are accessible:
•
Application List
on page 418: Displays all applications available for use.
•
Application Filter
on page 419: Enables you to control access to the applications.
•
Traffic Shaping Default
: Apply traffic shaping policy to the application category or to the individual application within the category.
Application List
This page displays all the applications available for use.
The device can identify and control applications that use standard ports, non-standard ports, or port hopping, or that tunnel through encrypted SSL traffic. This feature enables prioritization of applications based on user identity, time, and bandwidth, allowing great flexibility, visibility, and control. The device also provides implementation of application-based bandwidth management, accelerating critical applications while blocking malware-laden sites through web filtering. Organizations can group applications as per their requirements into business-critical, entertainment, communication, or collaboration, and can control access through security policies.
Note: You need a subscription to Web Protection before you can use this feature. Check its features by taking a free trial. (See System > Administration > Licensing)
Sophos XG Firewall | Protect | 419
The device is shipped with a set of predefined applications. These applications are classified based on their risk level, characteristics and technology, offering more granular controls.
The total number of application signatures included depends on the Application Signatures Database used by the device.
The application list can be filtered based on name of the application, category of the application, risk, characteristics, and technology.
Application Filter
This page displays a list of all the predefined and custom policies.
An Application Filter Policy controls a user’s application access. It specifies which user has access to which applications and allows you to define powerful security policies based on almost limitless policy parameters like:
• Individual users
• Groups of users
• Time of day
The device is shipped with the following predefined policies for application filters to address common use cases:
• Allow All: By default, allows access to all the categories except the specified categories. Access to the specified categories depends on the strategy defined for each category.
• Deny All: By default, denies access to all the categories except the specified categories. Access to the specified categories depends on the strategy defined for each category.
• Block filter avoidance apps: Drops traffic from applications that tunnel other applications, proxy and tunnel applications, and from applications that can bypass firewall policy. These applications allow users to anonymously browse the Internet by connecting to servers on the Internet via encrypted SSL tunnels. This, in turn, enables users to bypass network security measures.
• Block generally unwanted apps: Drops generally unwanted application traffic. This includes applications such as file transfer, proxy & tunnel, risk prone, peer to peer networking (P2P) and applications that cause loss of productivity.
• Block high risk (Risk Level 4 and 5) apps: Drops traffic from applications that are classified under 'high risk' applications (Risk Level- 4 and 5).
• Block peer to peer (P2P) networking apps: Drops traffic from applications that are categorized as P2P applications. P2P could be a mechanism for distributing Bots, Spywares, Adware, Trojans, Rootkits, Worms and other types of malwares. It is generally advised to have P2P applications blocked in your network.
• Block very high risk (Risk Level 5) apps: Drops traffic from applications that are classified under 'very high risk' applications (Risk Level- 5).
These predefined policies are immediately available for use. You can also define custom policies to specify different levels of access for different users to meet your organization’s requirements.
The page also provides options to add a new policy, update the parameters of an existing policy, delete a policy, add a filtering rule to a policy, or delete a filtering rule attached to a policy.
Note: You cannot edit/delete Allow All and Deny All predefined policies.
Pocket Guides
•
How to setup application filter
Add Application Filter Policy
This page lets you configure custom policies to define different levels of access for different users to meet your organization’s requirements.
The Add page allows you to manually configure policies.
1. Go to Protect > Applications > Application Filter and click Add.
2. Enter the Application Filter Policy details.
Sophos XG Firewall | Protect | 420
Name
Enter a name to identify the Application Filter Policy.
Description
Enter description for the Application Filter Policy.
Enable Micro App Discovery
Enable to scan and classify microapps using HTTP protocol for communication. Microapps are applications that are used withing web browsers.
To allow/deny microapps, you need to specify action accordingly.
Refer Appendix D - Supported Micro-Apps for more details on supported applications.
Template
Select template for the Application Filter Policy.
Figure 389: Application Filter
3. Click Save.
4. Once the policy is added, next step is to add a rule for configuring filtering criteria.
Note:
• Rules can be added for custom policies only.
• If Micro App Discovery is enabled, one has to import SSL CA to avoid Certificate error.
Add Application Filter Policy Rules
Use the Add Application Filter Policy Rules page to configure a new rule for Application Filter Policy.
The Add Application Filter Policy Rules page allows you to manually configure a new rule.
1.
Go to Protect > Applications > Application Filter and click .
2. Click Add under Application Filter Policy.
3. Enter the application filter details.
Category
Select Application Category from the list of available categories.
Risk
Select the level of risk from the available options.Select All1 - VERY LOW 2 - LOW3 - MEDIUM
4 - HIGH5 - VERY HIGH
Characteristics
Select the characteristics from the available options.Select AllExcessive BandwidthProne to misuseTransfer filesTunnels other appsVulnerabilities Widely usedLoss of productivityCan bypass firewall policy
Sophos XG Firewall | Protect | 421
Technology
Select the technology from the available options.Select AllBrowser BasedClient ServerNetwork
ProtocolP2P
Figure 390: Application Filter Criteria
4. Enter the list of matching applications.
Select All
Click to select all the Applications from the list.
Applications are available based on the Application Filter Criteria.
Select Individual Application
Click to select the Applications from the list.
Applications are available based on the Application Filter Criteria.
Search
Specify the name of the application in the textbox to be searched.
This option is available, only if option "Select Individual Application" is selected.
Name
Displays name of the Applications under the Category selected. You can also select more than one application using the checkbox.
Description
Displays description of the Application.
Category
Displays category of the Application.
Risk
Displays the risk factor involved with the Application.
Characteristics
Displays the characteristics of the Application.
Technology
Displays the technology utilized for the Application.
Sophos XG Firewall | Protect | 422
Figure 391: List of Matching Applications
5. Enter the action you want to perform.
Action
Select an Action for the Policy from the available options. Allow Deny
Schedule
Select schedule from the list available in the dropdown list.
Figure 392:
6. Click Save.
Traffic Shaping Default
The Traffic Shaping Default page allows you to view the list of all application categories. This page also provides the option to edit the category or application to apply a traffic shaping policy.
The applications shipped with the device are grouped into categories. These categories can be used in filtering policy and bandwidth restriction can be applied to the category or to the individual application within the category.
The categories list can be filtered based on name of the category. Use the or toggle beside the category name to expand and collapse the list of applications grouped in the respective category.
Configure Traffic Shaping Policy for Category or Application
Use this page to configure traffic shaping policy.
This page allows you to configure traffic shaping policy for category or application.
