Sophos XG Firewall | Protect | 390
Web
Use the web protection settings to identify and block the latest web threats. These settings let you control traffic and protect against threats and inappropriate web usage. Exceptions let you override settings as required for your business needs.
Policies
With policies, you can control traffic using rules and advanced settings. The default set of policies describes some common restrictions.
To test and troubleshoot policies, click Policy Test.
Figure 350: Policies
Rules
Rules specify the following criteria:
• Users to whom the rule applies. These include groups and individual users.
• Activities that describe the type of usage to restrict. These include user activities, categories, URL groups, file types, and dynamic categories.
• Content filters to restrict web content that contains any terms in the lists specified.
• An action to take when the firewall encounters traffic that matches the rule criteria.
The firewall evaluates rules from highest to lowest. For example, a rule that allows all traffic that precedes a rule that restricts a specific type of traffic takes precedence and the subsequent rule is ignored.
Figure 351: Rules
Sophos XG Firewall | Protect | 391
Migrating Policies from Previous Releases
This release supports up to 128 rules in a single policy. If you are migrating policies from a previous release that contain more than 128 rules, only the first 128 rules will be used.
Web policy rules now support combined activities. These include user activities, categories, URL groups, file types, and dynamic categories.To maintain the overall functionality of the policy, replace blocks of adjacent rules for different activities with a single rule that contains a group of activities. Please delete or consolidate rules as required.
Add Policy
1. Go to Protect > Web > Policies and click Add Policy.
2. Type a name.
3. Click Add Rule.
Tip: To use an existing rule as a template, click the Clone button ( ).
The firewall creates a default rule that blocks all web traffic for all users. The default rule is disabled.
Figure 352: Add Rule
4. Specify users.
a) In the new rule, move the pointer over the users field, click the user (“Anybody”), and then click Add New
Item.
b) Clear the Anybody check box.
c) Select users.
Tip: You can filter the type of users to display by clicking Show Only and selecting a user type.
d) Click Apply selected items.
Sophos XG Firewall | Protect | 392
Figure 353: Select Users
5. Specify activities and content filters.
a) Move the pointer over the activities field, click the activity (“AllWebTraffic”), and then click Add New Item.
b) In the Activities tab, clear the All Web Traffic check box.
c) Select activities.
Tip: You can filter the type of activities to display by clicking Show Only and selecting an activity type.
d) Click Apply selected items.
e) Click the Content Filters tab and enable the and with content check box.
f) Click Add New Item and select filters.
g) Click Apply selected items.
6. In the Action field, specify an action to take when the firewall encounters HTTP traffic that matches the selected criteria .
Select from the following options:
Options
Allow Warn Block Log
7. (Optional) Specify an action to take when the firewall encounters HTTPS traffic that matches the selected criteria.
Note: Follow these steps only if you want to specify an action for HTTPS traffic that is different from the one you specified for HTTP.
a) Move the pointer to the right of the Action list.
The firewall displays the HTTPS Use Action list.
Figure 354: HTTPS Use Action
b) Select an option.
HTTPS Use Action
Use Action: Select this option to use the same action that is currently in effect for HTTP traffic. If you specify a different HTTP action at a later time, HTTPS action will also use that action. Allow:
Always allow HTTPS traffic that matches the selected criteria. Warn: Always display a warning message when encountering HTTPS traffic that matches the selected criteria. Block: Always block
HTTPS traffic that matches the selected criteria.
8. Move the pointer over the Constraints field and select a schedule.
Tip: You can create a new schedule by clicking Create new and specifying criteria.
Sophos XG Firewall | Protect | 393
9. Click the On/Off switch to enable the rule.
Figure 355: Enable Rule
10. Click and drag the rule handle to position the rule in the hierarchy.
Figure 356: Position Rule
The firewall evaluates rules from highest to lowest. For example, a rule that allows all traffic that precedes a rule that restricts a specific type of traffic takes precedence and the subsequent rule is ignored.
11. Click Advanced Settings and specify settings for the policy.
Enable logging and reporting
Include this policy in logs and reports.
Prevent downloading of large files
Prevent downloading files greater than the size specified.
Restrict login domains for Google Apps
Restrict logging in to Google Apps only on the domains specified.
For your policies to take effect, add them to a firewall rule.
User Activities
User activities combine web categories, file types, and URL groups in one container. For example, you can create a user activity to associate spyware and malware with a list of URLs. You can include user activities in web policies to control access to websites or files that match any of the specified criteria.
Add User Activity
1. Go to Protect > Web > User Activities and click Add.
2. Type a name.
3. Click Add New Item and select categories.
Select from the following:
• Web categories
• File types
• URL groups
Note: Categories are evaluated using ‘OR’. Only one category must return true in order to match traffic.
Tip: You can filter the type of categories to display by clicking Show: All and selecting a category type.
Sophos XG Firewall | Protect | 394
Figure 357: Add User Activity
Categories
With web categories, you can organize and classify domains in a container. The default categories define some common content types. You can use categories within policies to restrict access to websites.
Add Category
1. Go to Protect > Web > Categories and click Add.
2. Type a name.
3. Specify details.
Classification
Use classifications to group content types. Select from the following options:
• Productive
• Unproductive
• Acceptable
• Objectionable
Traffic Shaping Policy
If you want to apply a bandwidth restriction, choose a traffic shaping policy.
Configure Category
Specify domains and keywords for the category using a configuration type. Select from the following options:
• Local - Define domains and keywords that are specific to your organization. To import a domain or keyword list, click Choose File and select a text file. To create a domain or keyword list, type a domain or keyword in the Search/Add text box and click the Add button ( ).
• External URL Database - An external URL database contains a list of domains that is maintained by a third party. These include, for example, country-specific blacklists and opensource URL categorization lists. To specify an external URL database, type a URL in the
Search/Add text box and click
. The firewall checks for updates every two hours.
Acceptable formats: .tar, .gz, .bz, .bz2, and .txt
Sophos XG Firewall | Protect | 395
Figure 358: Add Category
4. Specify Advanced Settings.
Override Default Denied Message
Select this option to define a custom message that will be shown to the user when a website is blocked as a result of this category.
Figure 359: Advanced Settings
Related concepts
Firewall
on page 303
Firewall rules are security rule-sets to implement control over users, applications or network objects in an organization. Using the firewall rule, you can create blanket or specialized traffic transit rules based on the requirement. This page provides centralized management for the entire set of device firewall rules. Sophos XG
Firewall implements a single pane of management to secure all enterprise applications using configuration templates for various rule types.
Traffic Shaping
on page 297
URL Groups
URL groups contain one or more URLs that you can use in web policies to block or allow access to websites.
Add URL Group
1. Go to Protect > Web > URL Groups and click Add.
2. Type a name.
3.
Type a URL in the Search/Add text box and click the Add button ( ).
Sophos XG Firewall | Protect | 396
Figure 360: Add URL Group
Exceptions
With exceptions, you can override protection settings for web traffic that matches the specified criteria. For example, you can create an exception to skip HTTPS decryption for sites that contain confidential data. The default set of exceptions specifies some common override behaviors.
Override behaviors now include Sandstorm.
Note: Existing exceptions that skip malware scanning now also skip Sandstorm analysis.
Add Exception
1. Go to Protect > Web > Exceptions and click Add Exception.
2. Type a name.
3. Specify web traffic criteria.
Note: The firewall evaluates all types of criteria specified using the “AND” operator. For example, if you specify URL patterns and website categories, both types must return true in order to match traffic.
However, within each category, criteria are evaluated using “OR”.
URL pattern matches
Match web traffic according to the specified URL or pattern, for example, example.com. Regular expressions are allowed here. For example, ^([A-Za-z0-9.-]*\.)?example\.com/ matches all subdomains of example.com.
Note: You must specify pattern matches using ASCII characters. For information about converting non-ASCII characters, refer to
RFC 3490, Internationalizing
Domain Names in Applications
.
Website categories
Match web traffic according to the specified web categories.
Source IP addresses
Match web traffic that originates from the specified IP addresses.
Destination IP addresses
Match web traffic going to the specified IP addresses.
Sophos XG Firewall | Protect | 397
Figure 361: Add Exception
4. Specify an action to skip when the firewall encounters traffic that matches the criteria.
HTTPS Decryption
Do not decrypt HTTPS for traffic that meets the specified criteria.
Note: If you disable HTTPS decryption, the firewall will not perform any other check that relies on decrypted traffic, such as malware scanning. However, the firewall will continue to scan HTTP traffic that matches the exception.
Malware and Content Scanning
Do not scan traffic that meets the specified criteria for malware or content as specified in a content filter.
Sandstorm
Do not send files that are downloaded using the specified criteria to Sandstorm for analysis.
Policy Checks
Do not check policies for traffic that meets the specified criteria.
File Types
A file type is a classification that is determined by file extension and MIME header. You can include file types in web policies to control access to files that match the specified criteria. The default file types contain some common criteria and you can create additional types.
Sophos XG Firewall | Protect | 398
Using File Types with Policy Rules
You can create file types to control access to files on a more granular level. For example, you may want to allow access to SQL files but deny access to all other database files. In this case, you would create a file type for SQL files and a policy that specifies the following rules in the following order:
1. Allow access to SQL files
2. Block access to all database files
Add File Type
1. Go to Protect > Web > File Type and click Add.
2. Type a name.
3. (Optional) Select a template.
You can select from predefined or custom file types. If you do not wish to use a template, choose Blank.
4. Specify the file extension and MIME header.
Figure 362: Add File Type
Surfing Quotas
Surfing quota policy allows you to assign the duration of Internet surfing time to users and groups.
• Duration of Internet access can be cyclic or non-cyclic.
• You can apply the surfing quota policy to users.
The device is shipped with the following predefined policies. Predefined policies can be applied straight away to users and groups.
• Unlimited Internet Access
• 1 Month Unlimited Access
• 1 Month 100 hours
• Monthly 100 hours Cyclic
• Daily 1 hour Cyclic
• Weekly 7 hours Cyclic
Note:
Sophos XG Firewall | Protect | 399
1. Users generally belong to a group. If the surfing quota policy applied to the user differs from the one applied to the user’s group, the user’s policy takes priority.
2. For details of policies and rules to which the surfing quota policy can be applied, view the following diagram.
Add Surfing Quota
To assign the duration of Internet surfing time to users and groups, you can create surfing quota policies. These policies are then applied to users (Configure > Authentication > Users) and groups (Configure > Authentication >
Groups).
The Add Surfing Quota Policy page allows you to create a surfing quota policy.
1. Go to Protect > Web > Surfing Quotas or System > Profiles > Surfing Quotas and click Add on the upper right side.
Note: Surfing Quota policies can also be created when applying the policy to users or groups from the respective pages. The Surfing Quota page displays the full list of predefined and custom policies.
2. Enter the details.
Sophos XG Firewall | Protect | 400
Name
Enter a unique name to identify the policy.
Description
Enter a description for the surfing quota policy.
Cycle Type
Select the cycle type.
Available Options:Cyclic: Duration of Internet access recurs for each cycle.Non-Cyclic: When the specified time limit ends, the user is disconnected.
Cycle Hours (available only if Cycle Type is Cyclic)
Specify the cycle hours in hours and minutes. Select the cycle from the drop-down list. Cycle hours define the upper limit of surfing hours for daily, weekly, monthly or yearly cycles.
At the end of each cycle, cycle hours are reset to zero.
Example: If cycle hours specified are 7 hours 30 minutes for a daily cycle, they are reset to zero at the end of each day whether cycle hours are fully or partially used or remain unused.
Validity
Select Unlimited if you do not want to restrict the validity period. Clear the check box to specify the validity period of Internet access.
Maximum Hours
Select Unlimited if you do not want to restrict the maximum allowed surfing duration. Clear the check box to specify the maximum duration (in hours and minutes) of surfing time allowed across the validity period.
Example: Cyclic Policy
Cycle Hours: 5 hours per day
Validity: 5 days
Maximum Hours: 20 hours
If the user accesses Internet for 5 hours each day, the user will have used 20 hours of Internet access by the end of the fourth day and hence will be disconnected.
Example: Non-Cyclic Policy
Validity: 10 days
Maximum Hours: 10 hours
The user is disconnected at the end of 10 hours even if the validity period does not expire.
