Configuring URL filtering policies for Web sites

Symantec Web Gateway can block, monitor, or allow access to categories of Web sites. For example, you can block access to gambling Web sites, allow access to business Web sites, and monitor access to entertainment Web sites. To block Web sites by category, you must have the URL filtering license.

Symantec Web Gateway applies content filter policies to embedded URLs. However, whitelisted domains and domain exceptions that you specify in content filter policies are not applied to embedded URLs. An embedded URL is when a URL contains another URL within it. The embedded URL in the following example is badurl.com:

http://symantecexample.com/index.html/?badurl.com/home.js

See Preinstallation checklist.

See URL filtering categories.

Symantec Web Gateway does not support the ability to redirect URLs or block URLs if you use the port span/tap configuration and any of the following conditions exist:

  • Your organization uses a corporate switch that implements Access Control Lists (ACL)

  • Your network has a feature that prevents session hijacking

Note:

You must enable the content filter module to monitor or block Web sites.

See Enabling URL filtering, Internet program monitoring, and other features.

When a user attempts to access a Web site in a blocked category, a message appears in the Web browser instead of the Web site. You can configure the message.

See End user pages for blocked Web sites, file transfers, and infections.

Note:

If you use the SSL proxy, users cannot see your custom end user page when they attempt to access a domain in which no intercept policy exists. This situation can occur if you do not have an SSL intercept policy for a certain category, but you do have a content filtering blocking policy for that category. The message that they see depends on the Web browser that they use. For example, Internet Explorer displays a forbidden error message. Firefox displays a message that the proxy server refuses the connection. This issue occurs for HTTP/HTTPS or deep inspection ports.

See Internet applications, malware, and URL filtering blocking behavior.

You can configure content filter exceptions for specific Web sites. Content filter exceptions apply to a single policy. You set Symantec Web Gateway to allow, block, or monitor the Web site in each content filter exception. For example, assume that you set the Spam URLs filtering category to Block and that www.blocksads.com is in that category. For that policy, if you want to monitor access instead of block access, set a content filter exception for www.blocksads.com to Allow. These content filter exceptions act like a policy-specific blacklist or whitelist. The blacklist and whitelist in Symantec Web Gateway provide more global behavior.

See Blocking or monitoring Web sites using the blacklist.

See Allowing Web site access using the whitelist.

To configure URL filtering policies for Web sites

  1. Specify the policy name and the range of computers to include in the policy.

    See Specifying computers or users for policies.

  2. Continuing on the Policies > Configuration page, locate Multiple Categories.

    To configure after hours access, check Allow After Hours Configuration and specify those settings.

    See Allowing after hours access to Web sites.

  3. Under Multiple Categories, click one of the following:

    Restrictive: Block takes precedence

    If a block action and an allow action both apply to a Web site, the Web site is blocked. Restrictive: Block takes precedence is the default setting.

    Permissive: Allow takes precedence

    If a block action and an allow action both apply to a Web site, the Web site is allowed.

    Web sites can be classified under more than one category. For example, a Web site selling sports equipment might be categorized as both a sports Web site and a shopping Web site. This option determines the action that Symantec Web Gateway takes if conflicting actions apply to a Web site.

  4. To specify the default action type for all Web site categories, click one of the following options:

    Block All

    By default, block all Web site categories. Attempts to access blocked Web sites appear in reports.

    Allow All

    By default, allow access to all Web site categories.

    Monitor All

    By default, monitor all Web site categories. Access to all Web sites is allowed, but Symantec Web Gateway records visits by category for display in reports.

    You can individually set the action options for specific categories or subcategories after selecting one of these options.

  5. To specify the action type for categories, click one of the following options for the category:

    Block All

    By default, block Web sites in this category. Attempts to access blocked Web sites appear in reports.

    Allow All

    By default, allow access to Web sites in this category.

    Monitor All

    By default, monitor Web sites in this category. Symantec Web Gateway allows access to Web sites in this category. Symantec Web Gateway records visits by category in reports.

    See URL filtering categories.

  6. To specify the action type for subcategories, click Block, Allow, or Monitor.

  7. To configure access for a specific Web site or IP address, click Add an Exception.

    Specify a domain name or IP address and then click an action type. If you specify a domain name, type only the domain name. Omit the http:// prefix and any slashes such as for folders in the URL.

    Alternatively, you can click an action type and import a text file that contains one domain name or IP address per line. The action type you click is set for all addresses in the file.

  8. Configure other policy settings as desired.

  9. Click Save.

  10. On the Policies > Configuration main page, click Save and Activate Changes.

Imported Document ID: HOWTO54138
Legacy ID: v28705380_v58977240

Thanks for your feedback. Let us know if you have additional comments below. (requires login)

    © 1995-2019 Symantec Corporation