Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Refine Your Policies > Protocol-based policy enforcement
Protocol-based policy enforcement
Administrator Help | TRITON AP-WEB and Web Filter & Security | Version 8.0.x
Related topics:
*
Editing custom protocols
*
Creating a custom protocol
*
Adding or editing protocol identifiers
*
Adding to a Websense-defined protocol
The Websense Master database includes protocol definitions used to manage Internet protocols other than HTTP, HTTPS and FTP. These definitions include Internet applications and data transfer methods such as those used for instant messaging, streaming media, file sharing, file transfer, Internet mail, and other network and database operations.
These protocol definitions can even be used to manage protocols or applications that bypass a firewall by tunneling through ports normally used by HTTP traffic. Instant messaging data, for example, can enter a network whose firewall blocks instant messaging protocols by tunneling through HTTP ports. Websense software accurately identifies these protocols, and filters them according to policies you configure.
*
With TRITON AP-WEB, Content Gateway can be configured to detect non-HTTP protocols that tunnel over HTTP ports. See Configuring tunneled protocol detection for more information. Network Agent can also be used to manage non-HTTP protocols.
*
In Websense Web Filter & Security deployments, Network Agent must be installed to enable protocol-based policy enforcement.
How protocol requests are managed
When a protocol request is made, the following steps are used to determine whether to block or permit the request:
1.
Determine the protocol (or Internet application) name.
2.
Identify the protocol based on the request destination address.
3.
Search for related port numbers or IP addresses in custom protocol definitions.
4.
Search for related port numbers, IP addresses, or signatures in Websense-defined protocol definitions.
If any of this information cannot be determined, all content associated with the protocol is permitted.
If the protocol is FTP, HTTPS, or gopher, a check is first performed to see if the protocol is blocked. If the protocol is permitted, Filtering Service performs a URL lookup to see if the requested site is permitted or blocked.
Defining custom protocols
In addition to using Websense-defined protocol definitions, you can define custom protocols. Custom protocol definitions can be based on IP addresses or port numbers, and can be edited.
To block traffic over a specific port, associate that port number with a custom protocol, and then assign that protocol a default action of Block. When ports are used to define a protocol, blocking the port intercepts all Internet content entering your network over that port, regardless of source.
 
* 
Note 
Occasionally, internal network traffic sent over a particular port may not be blocked, even though the protocol using that port is blocked. The protocol may send data via an internal server more quickly than Network Agent can capture and process the data. This does not occur with data originating outside the network.
To work with custom protocol definitions, go to Policy Management > Filter Components, and then click Protocols. See Editing custom protocols and Creating a custom protocol for details.
 

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Refine Your Policies > Protocol-based policy enforcement
Copyright 2016 Forcepoint LLC. All rights reserved.