User manual SONICWALL SONICOS 5.8 CFS 3.0 FEATURE MODULE REV A

[. . . ] Allowed actions on this policy type include: ­ HTTP Block Page ­ Manage Bandwidth ­ No Action ­ CFS Block Page ­ Packet Monitor Allowed Zones include: ­ LAN ­ DMZ ­ SSLVPN ­ VPN ­ WLAN Note CFS Message Format Checkbox ­ By default, messages are logged in Application Firewall format. This checkbox allows you to log using message format standard for CFS. Content Filtering Service 3. 0 3 CFS 3. 0 Policy Management Overview CFS 3. 0 Policy Management Overview When a CFS policy assignment is implemented using the Application Firewall method, it is controlled by Application Firewall CFS policies in the Application Firewall > Policies page instead of by Users and Zones. While the new Application Firewall method of CFS management offers more control and flexibility, the administrator can still choose the previous user/zone management method to perform content filtering. This section includes the following sub-sections: · · · · Bandwidth Management Methods -- page 7 Choosing CFS Policy Management Type -- page 6 Enabling Application Firewall and CFS -- page 6 Bandwidth Management Methods -- page 7 The CFS Application Firewall Policy Settings Screen There are multiple changes/additions to the CFS policy creation window when used in conjunction with Application Firewall. [. . . ] Click the Add New Match Object button, the Add/Edit Match Object window displays. Select `CFS Category List' from the Match Object Type dropdown list. Use the checkboxes to select the categories you wish to add to the forbidden content list. Step 6 Click the OK button to add the object to the Application Objects list. 8 Content Filtering Service 3. 0 CFS 3. 0 Configuration Examples Create an Application Firewall Policy to Block Forbidden Content Create an Application Firewall policy to block content defined in the Application Object: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Navigate to the Firewall > App Rules page in the SonicOS management interface. Click the Add Policy button, the Add/Edit Application Firewall Policy window displays. Enter a descriptive name for this action in the Policy Name field, such as `Block Forbidden Content'. From the Application Object dropdown list, select the object you created in the previous section. In the case of our example, this object is named `Forbidden Content'. From the Action dropdown list, select `CFS block page' to display a pre-formatted `blocked content' page when users attempt to access forbidden content. Optionally, select the Users/Groups who this policy is to be Included or Excluded on from the dropdown list. Our example uses the defaults of including `all' and excluding `none'. Optionally, select a Schedule of days and times when this rule is to be enforced from the dropdown list. Optionally, select the checkbox for Log using CFS message format if you wish for the logs to use this format instead of the standard Application Firewall format. `LAN' to enforce the policy on all traffic traversing the local network. Step 10 Optionally, select the appropriate Zone where the policy is to be enforced. Our example uses Step 11 Optionally, select a CFS Allow List to enforce on this particular policy. Step 12 Optionally, select the appropriate CFS Forbidden List to enforce on the particular policy. Step 13 Click the OK button to create this policy. Content Filtering Service 3. 0 9 CFS 3. 0 Configuration Examples Bandwidth Managing Content To create a CFS Policy for applying BWM to non-productive content: · · · Create an Application Object -- page 8 Create a Bandwidth Management Action Object -- page 11 Create an Application Firewall Policy to Block Forbidden Content -- page 9 Create an Application Object for Non-Productive Content Create an application object containing non-productive content: Step 1 Step 2 Step 3 Step 4 Step 5 Navigate to the Firewall > Match Objects page in the SonicOS management interface. Click the Add New Match Object button, the Add/Edit Match Object window displays. Enter a descriptive Object Name, such as `Non-Productive Content'. In the case of our example, this object is named `Nonproductive Content'. From the Action dropdown list, select `Bandwidth Management - 100k' to apply this custom BWM rule when users attempt to access non-productive content. Note If you chose not to create a custom BWM object, you may use one of the pre-defined BWM objects (BWM high, BWM medium, or BWM low). Optionally, select the Users/Groups who this policy is to be Included or Excluded on from the dropdown list. Our example uses the defaults of including `all' and excluding `none'. Optionally, select a Schedule of days and times when this rule is to be enforced from the dropdown list. [. . . ] CFS allows the administrator not only to create custom Policies, but also allows for custom domain name entries to the existing CFS rating categories. This allows for insertion of custom CFS-managed content into the existing and very flexible category structure. To create a new CFS custom category: · · Enable CFS Custom Categories -- page 14 Add a New CFS Custom Category Entry -- page 14 Enable CFS Custom Categories Step 1 Step 2 Step 3 Navigate to the Security Services > Content Filter page in the SonicOS management interface. Scroll down and click the CFS Custom Category section and select the Enable CFS Custom Category checkbox. [. . . ]