Web Gateway 7.1.5 Product Guide - McAfee

6
Web filtering
URL filtering
Rules for URL filtering
Rules that filter URLs are contained in a URL filtering rule set. This section explains an individual
filtering rule and describes the rules in a URL filtering rule set.
A rule set for URL filtering usually includes a blocking rule that blocks access to URLs per category and
one that blocks access according to reputation. A whitelisting rule exempts URLs that should not get
blocked from filtering.
The whitelisting rule is placed before the blocking rules, so it is processed before them. If a requested
URL matches an entry on the whitelist, the rule applies. It stops the processing of the rule set, so the
blocking rules are not processed and cannot apply.
A rule set like this is usually included when the wizard creates a system of rule sets. It is also included
in the default system. There can be several URL filtering rule sets in a rule set system, containing rules
that apply to different user groups.
URL filtering rule sets can differ from each other in that they use different blocking lists and whitelists.
They do not differ, however, in their basic structure, which combines a whitelisting rule with blocking
rules that block URLs individually or according to their categories and reputation scores.
View the implemented URL filtering rules
The URL filtering rules that are implemented on the appliance can be viewed on the user interface.
1 Go to Policy | Rule Sets.
2 On the rule sets tree, go to the rule set that contains the URL filtering rules, which is by default named
URL Filtering. The individual rules appear on the settings pane.
3 On the settings pane, click Show Details. Rule conditions and events are displayed for each rule.
You can modify these rules, delete them, and also create your own rules.
URL filtering rule
This section explains a category blocking rule, which is a key rule type in URL filtering.
Note: The rule is shown here in a notation that comes close to how it appears on the user interface.
Name
Block URLs whose category is in URL Category BlockList
Criteria Action
URL.Categories at least one in list Category BlockList –> Block
In plain text, this rule can be rephrased as follows:
If a URL belongs to a category that is on a blocking list, block access to it.
The property of the rule criteria is URL.Categories. This property is checked for a given URL and the URL
Filter module is called to find the categories the URL belongs to. If these are on the specified blocking
list, the criteria is matched and the rule applies.
The rule then executes its action, which is the Block action. It blocks access to the URL. If a URL
belongs to more than one category, it is blocked if any of these categories is on the list.
The URL.Categories property has the Default settings specified for it. This means the module that
retrieves the category information runs with these settings. The settings determine, for example,
whether a DNS lookup is performed for a URL and category information also searched for based on the
corresponding IP address.
188 McAfee Web Gateway 7.1.5 Product Guide