Web Gateway 7.1.5 Product Guide - McAfee

1
Introduction
Comprehensive web security for your network
Main functions of the McAfee Web Gateway appliance
Filtering web traffic is a complex process. The main functions of the appliance contribute to it in
different ways:
• Filtering web objects — Special anti-virus and anti-malware functions on the appliance scan and
filter web traffic and block web objects when they are infected. Other functions filter requested URLs,
using information from the Global Threat Intelligence system, or do media type and HTML filtering.
They are supported by functions that do not filter themselves, but do such jobs as counting user
requests or indicating the progress made in downloading web objects.
• Filtering users — This is done by the authentication functions of the appliance, using information
from internal and external databases and methods such as NTLM, LDAP, RADIUS, Kerberos, and
others. In addition to filtering normal users, the appliance also gives you control over administrator
rights and responsibilities.
• Intercepting web traffic — This is a prerequisite for any filtering of web objects or users. It is
achieved by the gateway functions of the appliance, using different network protocols, such as HTTP,
HTTPS, FTP, Yahoo, ICQ, and Windows Live Messenger. As a gateway, the appliance can run in explicit
proxy mode or in transparent bridge or router mode.
• Monitoring the filtering process — The monitoring functions of the appliance provide a continuous
overview of the filtering process. They include a dashboard, displaying information on alerts, web
usage, filtering activities, and system behavior, as well as logging and tracing functions and options
to forward data to an ePolicy Orchestrator or do event monitoring with an SNMP agent.
Main administrator activities
The following are the main activities you need to complete when administering the appliance:
• Perform the initial setup — You can set up the appliance on a physical hardware platform or on a
virtual machine. The setup procedure includes the initial configuration of system parameters, such as
host name and IP address, implementing an initial system of filtering rules, and licensing.
Two wizards are available in this phase: one for the initial configuration, another for the filtering
rules.
• Configure the gateway functions — After the initial setup, explicit proxy mode and the HTTP
protocol are preconfigured on the appliance. You can modify this and also configure other network
components that the appliance communicates with.
• Modify filtering rules — The filtering rules are the building blocks of your web security policy. You
can review the system of filtering rules that has been implemented during the initial setup and modify
it. Authentication is not implemented by default.
Working on the filtering rules includes maintaining the lists that these rules use and configuring
the settings for rule actions and for the modules involved in the filtering processs.
• Monitor the appliance — When you have configured the appliance according to your requirements,
you can monitor it to see how it performs the filtering process. You can also monitor system functions,
such as CPU and memory usage, number of active connections, and others.
14 McAfee Web Gateway 7.1.5 Product Guide