Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 6: Configuring Application Defenses
Creating Web or Secure Web Application Defenses
166
• Modify an existing filter rule—To modify an existing filter rule, select the
rule you want to modify, and click Modify. See “Configuring MIME
filtering rules” on page 166. (If you are modifying the default MIME
filtering rule, see “Configuring the Default filtering rule action” on page
168.)
• Delete a filter rule—To delete an existing filter rule, select the rule you
want to delete and click Delete. You will be prompted to confirm your
decision.
2 Determine how infected files will be handled in the Infected File Handling
area as follows:
• To discard infected files, select Discard Infected Files.
• To remove the virus from the file and then continue processing the file,
select Repair Infected Files.
3 To reject all files in the event that scanning is not available, select the
Reject All Files If Scanning Is Unavailable check box. If you select this
option, the connection will be dropped if scanning is unavailable.
4 In the Scan File Size Limit (KB) field, specify the maximum file size that will
be allowed in KB. If a file exceeds the size specified in this field, filtering will
not take place and the file will be denied.
Configuring MIME filtering rules
When you click New or Modify beneath the MIME/Virus/Spyware Filter Rules
area, the MIME/Virus/Spyware Rule Edit window appears. This window allows
you to add or modify MIME/Virus/Spyware filtering rules.
Important: Rules that are configured with an allow or deny action will allow or deny
traffic based on the rule criteria that is defined for those rules. Allow and deny rules
do not perform virus scanning. To perform virus scanning for traffic that matches a
rule before it is allowed, you must specify Virus/Spyware Scan in the rule’s Action
field.
By default, a single allow rule is contained in the filter rule table. If you choose
to leave the default allow rule as the last rule in your table (that is, all traffic that
isn’t explicitly denied will be allowed), you will need to configure the appropriate
virus scan and/or deny rules and place them in front of the default allow rule. If
you configure the default rule action to deny (that is, all traffic that is not
explicitly allowed will be denied) you will need to configure the appropriate
virus scan and/or allow rules and place them in front of the default deny rule.
To create MIME/Virus/Spyware rules, follow the steps below.
Note: Rules that specify both a MIME type/subtype and file extensions will allow or
deny any traffic that matches either the MIME Type or a File Extension type. That
is, the traffic does not need to match both criteria to match the rule.