Web Gateway 7.1.5 Product Guide - McAfee

4
Rules and rule sets
Rule configuration
Property and Criteria
The property used in the criteria of the rule is URL. Its meaning can be paraphrased as “being a URL”.
If a requested web object is a URL, then the rule is processed to see if it is on a particular whitelist.
The whitelist is specified in the rule criteria as Global Whitelist. For looking up whether a given URL is
on it, no special module is needed. Therefore the criteria includes no settings for a module.
Action
If the criteria of the rule matches, the rule applies and the Stop Cycle action is executed, with the
impact that is the purpose of the rule. All measures that might prevent users from accessing the URL
are avoided.
The Stop Cycle action stops the request cycle when a request for access to the URL has been received.
Since the rule set of the rule is processed in all three cycles of the filtering process, the Stop Cycle
action can also stop the response or the embedded object cycle if a whitelisted URL is involved in these.
The Stop Cycle action does not affect a user in the way that a blocking action would do. If the action
and its rule work as intended, the user is allowed to access the requested URL. No message to the user
is therefore needed, so the action of this rule has no settings to specify such a message.
Process flow
If processing the rule leads to the result that a URL is on the specified whitelist, the current cycle of the
filtering process stops, according to what the rule says. Other cycles of the process can go on. For
example, if an embedded object was sent with the request, the embedded object cycle could be started
to filter this object.
If the request cycle is stopped after the whitelisted URL has been sent, the request is passed on the
appropriate web server. The appliance then waits for a response from this server, and if this is
received, the response cycle of the filtering process is started to process this reponse.
Block URLs whose category is in Category BlockList (Sample rule)
This rule can be included in a rule set for URL filtering.
Rule
Name
Block URLs whose category is in Category BlockList
Criteria Action
URL.Categories at least on in list Category Blacklist –> Block
In plain text, the rule could be rendered as follows:
If the category of a URL is on a particular blocking list, block access to this URL.
Purpose of the rule
This rule is for blocking URLs not individually, but per category. All URLs that are related to, for
example, drugs or online shopping are blocked. To achieve this, URL categories are entered on a
blocking list.
If a requested URL falls under a category that is on the list, the rule stops processing completely. The
request is not passed on to the appropriate web server and the user who requested the URL cannot
access it. In this sense, the URL is blocked.
Property and criteria
The property used in this rule is URL.Categories. Its meaning could be paraphrased as “belonging to a
URL category”. If a requested web object is a URL, it is checked whether its categories are on the
specified blocking list. If the URL belongs to more than one category, only one of them on the list is
sufficient to trigger the blocking, as the rule says it: at least one in list.
106 McAfee Web Gateway 7.1.5 Product Guide