Web Gateway 7.1.5 Product Guide - McAfee

Authentication and access management
Quota management 5
Authorized Override
You can configure session time for a session that allows authorized overriding. When this session time
has elapsed, a user request is blocked and a block message is displayed. The message also asks for
submission of a user name and password to start a new session.
These credentials must be those of an authorized user. For example, in a classroom situation, a user
who gets blocked after termination of an authorized override session could be a student, while the
teacher is the authorized user.
The block message also provides an option to specify the time length of the authorized override session
for the user who was blocked.
Note: The time length that is configured for this user should not exceed the time length configured for all
other users as part of the module settings for authorized overriding.
You can configure authorized overriding in relation to the parameters used in the Authorized Override
library rule set, such as URL categories, IP addresses, and user names. You can also create rules of
your own using other parameters.
Blocking Sessions
By configuring blocking sessions you can block requests sent by a user for a configured period of time
after the user has sent a request that is blocked according to a configured rule, for example, a request
for a URL that falls into a category on a list used by a blocking rule.
This is a means of enforcing a web security policy that handles unwanted access to web objects with
more strictness.
You can configure blocking sessions in relation to the parameters that are used in the Blocking Sessions
library rule set. You can also create rules of your own using other parameters.
Combining quota management functions
Using a particular quota management function to restrict web usage has no impact on the use of other
quota management functions. For example, time quotas and volume quotas are configured and
implemented separately on the appliance.
You can, however, combine these functions in meaningful ways. For example, you can impose coaching
on users’ access to some URL categories, while requesting authorized override credentials for other
categories. For still another group of categories you could block users who attempt to access them over
a configured period of time.
Rules for quota management
Rules for quota management are contained in several rule sets. Each rule set deals with a particular
quota management function, such as time quota, volume quota, coaching, and others. This section
describes the rules in these rule sets and explains how to configure them to implement quota
management.
Time Quota (rule set)
This section describes the rules in a library rule set for implementing time quotas.
For general information on understanding and handling rules, see Rules and rule sets.
Library rule set — Time Quota
Criteria — SSL.Client.Context.IsApplied equals true OR
Command.Name does not equal “CONNECT”
Cycle — Requests (and IM)
The rule set criteria specify that the rule set applies to SSL-secured communication, as well as to other
communication, where the CONNECT command is not used at the beginning.
McAfee Web Gateway 7.1.5 Product Guide 149