Web Gateway 7.1.5 Product Guide - McAfee

Rules and rule sets
Filtering controlled by rules 4
When embedded objects are sent with requests or responses (3), the embedded objects cycle is used
as an additional cycle of processing.
Figure 4-2 Filtering embedded objects
An embedded object could, for example, be a file sent with a request to upload a file and embedded in
this file. The filtering process begins with the request cycle, filtering the request and checking the file
that is requested for uploading. Then the embedded objects cycle is started for the embedded file.
Similarly, the response cycle and the embedded objects cycle are started one after another for a file
that is sent in response from a web server and has another file embedded in it.
For every rule on the appliance, it is specified in which cycle it is processed. However, the cycle is not
specified individually for a rule, but for the rule set that contains it. A rule set can be processed in just
one cycle or in a combination of cycles.
Process flow
In the filtering process, the implemented rules are processed one after another, according to the
positions they take in their rule sets. The rule sets themselves are processed in the order of the rule set
system, which is shown on the Rule Sets tab of the user interface.
In each of the three cycles, the implemented rule sets are looked up one after another to see which
must be processed in this cycle.
When a rule is processed and found to apply, it triggers an action. The action executes a filtering
measure, such as blocking a request to access a web object or removing a requested object. In addition
to this, an action has an impact on the filtering process. It can specify that the filtering process must
stop completely, or skip some rules and then continue, or simply continue with the next rule.
Processing also stops after all implemented rules have been processed.
Accordingly, the process flow can be as follows:
All rules have been processed for
each of the cycles and no rule has
been found to apply.
–> Processing stops.
In the request cycle, the request is allowed to pass
through to the appropriate web server.
In the response cycle, the response sent from the web is
forwarded to the appropriate user.
In the embedded objects cycle, the embedded object is
allowed to pass through with the request or response it
was sent with.
Processing begins again when the next request is
received.
McAfee Web Gateway 7.1.5 Product Guide 83