Web URL Filters Test

Web filtering is a means of controlling the content that an Internet user is able to view. With the popularity of web applications, the need to monitor and control web access is becoming a key component of secure content management systems that employ antivirus, web filtering, and messaging security. Important reasons for controlling web content include:

  • lost productivity because employees are accessing the web for non-business reasons
  • network congestion — when valuable bandwidth is used for non-business purposes, legitimate business applications suffer
  • loss or exposure of confidential information through chat sites, non-approved email systems, instant messaging, and peer-to-peer file sharing
  • increased exposure to web-based threats as employees surf non-business-related web sites
  • legal liability when employees access/download inappropriate and offensive material
  • copyright infringement caused by employees downloading and/or distributing copyrighted material.

As the number and severity of threats increase on the World Wide Web, the risk potential increases within a company's network as well. Casual non-business related web surfing has caused many businesses countless hours of legal litigation as hostile environments have been created by employees who download and view offensive content. Web-based attacks and threats are also becoming increasingly sophisticated. Threats and web-based applications that cause additional problems for corporations include:

  • spyware/grayware
  • phishing
  • pharming
  • instant messaging
  • peer-to-peer file sharing
  • streaming media
  • blended network attacks.

The methods available for monitoring and controlling Internet access range from manual and educational methods to fully automated systems designed to scan, inspect, rate and control web activity.

Common web access control mechanisms include:

  • establishing and implementing a well-written usage policy in the organization on proper Internet, email, and computer conduct
  • installing monitoring tools that record and report on Internet usage
  • implementing policy-based tools that capture, rate, and block URLs.

The FortiGate unit applies web filters in a specific order:

  • URL filter
  • FortiGuard Web Filter
  • web content filter
  • web script filter
  • antivirus scanning.

The FortiGate firewall blocks the URLs that are mentioned in the URL filter list. The firewall is not only capable of blocking the URLs but also blocks the applets, cookies and Activex controls of the URLs in an active manner. Administrators can keep track on the number of hits to the blocked URLs using the Web URL Filters test.

By closely monitoring the FortiGate firewall, administrators can figure out the number of HTTP/HTTPS URLs that were blocked by the firewall as well as the number of applets, cookies and ActiveX controls of the URLs. This way, unwanted URLs can be blocked and the bandwidth consumption can be kept under check thus helping administrators maintain a prudent infrastructure at ease!

Target of the test : A FortiGate Firewall

Agent deploying the test : An external agent

Outputs of the test : One set of results for the target firewall being monitored.

Configurable parameters for the test
Parameter Description

Test Period

How often should the test be executed.

Host

The IP address of the host for which this test is to be configured.

Port

Refers to the port at which the specified host listens to.

SNMPPort

The port at which the monitored target exposes its SNMP MIB; The default value is 161.

SNMPVersion

By default, the eG agent supports SNMP version 1. Accordingly, the default selection in the SNMPversion list is v1. However, if a different SNMP framework is in use in your environment, say SNMP v2 or v3, then select the corresponding option from this list.

SNMPCommunity

The SNMP community name that the test uses to communicate with the firewall. This parameter is specific to SNMP v1 and v2 only. Therefore, if the SNMPVersion chosen is v3, then this parameter will not appear.

UserName

This parameter appears only when v3 is selected as the SNMPVersion. SNMP version 3 (SNMPv3) is an extensible SNMP Framework which supplements the SNMPv2 Framework, by additionally supporting message security, access control, and remote SNMP configuration capabilities. To extract performance statistics from the MIB using the highly secure SNMP v3 protocol, the eG agent has to be configured with the required access privileges – in other words, the eG agent should connect to the MIB using the credentials of a user with access permissions to be MIB. Therefore, specify the name of such a user against this parameter. 

Context

This parameter appears only when v3 is selected as the SNMPVersion. An SNMP context is a collection of management information accessible by an SNMP entity. An item of management information may exist in more than one context and an SNMP entity potentially has access to many contexts. A context is identified by the SNMPEngineID value of the entity hosting the management information (also called a contextEngineID) and a context name that identifies the specific context (also called a contextName). If the Username provided is associated with a context name, then the eG agent will be able to poll the MIB and collect metrics only if it is configured with the context name as well. In such cases therefore, specify the context name of the Username in the Context text box.  By default, this parameter is set to none.

AuthPass

Specify the password that corresponds to the above-mentioned Username. This parameter once again appears only if the SNMPversion selected is v3.

Confirm Password

Confirm the AuthPass by retyping it here.

AuthType

This parameter too appears only if v3 is selected as the SNMPversion. From the Authtype list box, choose the authentication algorithm using which SNMP v3 converts the specified username and password into a 32-bit format to ensure security of SNMP transactions. You can choose between the following options:

  • MD5 – Message Digest Algorithm
  • SHA – Secure Hash Algorithm

EncryptFlag

This flag appears only when v3 is selected as the SNMPversion. By default, the eG agent does not encrypt SNMP requests. Accordingly, the this flag is set to No by default. To ensure that SNMP requests sent by the eG agent are encrypted, select the Yes option. 

EncryptType

If this EncryptFlag is set to Yes, then you will have to mention the encryption type by selecting an option from the EncryptType list. SNMP v3 supports the following encryption types:

  • DES – Data Encryption Standard
  • AES – Advanced Encryption Standard

EncryptPassword

Specify the encryption password here.

Confirm Password

Confirm the encryption password by retyping it here.

Timeout

Specify the duration (in seconds) within which the SNMP query executed by this test should time out in this text box. The default is 10 seconds.

Data Over TCP

By default, in an IT environment, all data transmission occurs over UDP. Some environments however, may be specifically configured to offload a fraction of the data traffic – for instance, certain types of data traffic or traffic pertaining to specific components – to other protocols like TCP, so as to prevent UDP overloads. In such environments, you can instruct the eG agent to conduct the SNMP data traffic related to the monitored target over TCP (and not UDP). For this, set this flag to Yes. By default, this flag is set to No.

Measurements made by the test
Measurement Description Measurement Unit Interpretation

HTTP URLs blocked

Indicates the number of HTTP URLs that were blocked by the firewall.

Number

 

HTTPS URLs blocked

Indicates the number of SSL enabled HTTP URLs that were blocked by the firewall.

Number

 

ActiveX objects blocked

Indicates the number of ActiveX objects that were blocked by the firewall.

Number

 

Applets blocked

Indicates the number applets that were blocked by the firewall.

Number

 

Cookies blocked

Indicates the number of cookies that were blocked by the firewall.

Number