FortiGate Administration Guide - FirewallShop.com

Firewall Protection Profile
Configuring a protection profile
Rate images by URL
(blocked images will be
replaced with blanks)
(HTTP only)
Allow websites when a
rating error occurs
Strict Blocking
Rate URLs by domain
and IP address
Category
Classification
Block images that have been rated by FortiGuard. Blocked
images are replaced on the originating web pages with blanks.
Image types that are rated are GIF, JPEG, PNG, BMP, and
TIFF.
Allow web pages that return a rating error from the web filtering
service.
Strict blocking only has an effect when either a URL fits into a
category and classification or IP rating is enabled. With IP
rating enabled, all URLs have two categories and up to two
classifications (one set for the domain and one set for the IP
address). All URLs belong to at least one category (Unrated is
a category) and may belong to one classification too.
If strict blocking is enabled, a site is blocked if it is in at least
one blocked category or classification and only allowed if all
categories or classifications it falls under are allowed.
With strict blocking disabled, a site is allowed if it belongs to at
least one allowed category or classification and only blocked if
all categories or classifications it falls under are allowed.
For example, if a protection profile blocks “Search Engines” but
allows “Image Search” and the URL “images.google.ca” falls
into the Search Engines category and the Image Search
classification.
With strict blocking enabled, this URL is blocked because it
belongs to the Search Engines category, which is blocked.
With strict blocking disabled, the URL is allowed because it is
classified as Image Search, which is allowed. It would only be
blocked if both the Search Engines category and Image Search
classification were blocked.
This option is enabled by default.
When enabled, this option sends both the URL and the IP
address of the requested site for checking, providing additional
security against attempts to bypass the FortiGuard system.
However, because IP rating is not updated as quickly as URL
rating, some false ratings may occur.
This option is disabled by default.
The FortiGuard Web Filtering content filtering service provides
many categories by which to filter web traffic. Set the action to
take on web pages for each category. Choose from allow,
block, log, or allow override.
Classifications block whole classes of web sites. Web sites that
provide cached content, Google for example, can be blocked.
Web sites that allow image, audio, or video searches can also
be blocked. Web sites that are classified are also rated in one
of the categories or are unrated. Choose from allow, block,
monitor, or allow override.
See “FortiGuard - Web Filter” on page 435 for more category blocking
configuration options.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 335