Defining Web Policies

Related topics:

Creating a new policy

Testing policy enforcement

Uploading a policy assignment file

Configure custom categories

Configure block and notification pages

On the Web > Policy Management > Policies page, there is a list of policies currently configured for your account. Click a policy name to view or edit a policy.

There are several tabs associated with each policy. Depending on your subscription settings, you may not see all the tabs:

Custom Categories tab

Web Categories tab

Protocols tab

Application Control tab

File Blocking tab

Data Protection tab

Data Security tab (DLP Lite)

Web Content & Security tab

Standard account-level settings are shown in Standard Web Configuration.

Creating a new policy

To create a new policy:

Click Add.

Enter a policy name and administrator email address. This email address is used as the address from which system messages are sent. Your users may occasionally reply to these messages, so this should be an email address that is monitored by your IT staff or administrative contact.

Select the template you want to use for your policy. This can be one of the following:

A predefined template that determines which URL categories are blocked and which are permitted for a policy:

Default blocks a standard set of categories, including categories relating to adult material, drugs, violence, productivity, and security.

Basic blocks the most frequently blocked categories and permits the rest.

Basic Security blocks only categories considered to be a security risk.

Monitor Only permits all categories.

You can further refine how web traffic is managed changing the actions for individual categories on the Web Categories tab.

All other policy settings are as defined in Standard Web Configuration.

A copy of an existing policy. If you select Existing policy and choose one of your policies from the drop-down list, all of the current settings in that policy are copied into your new policy, except for the following:

Proxied connections

End user details

Category and application control exceptions


	Note Selecting Default from the policy template drop-down is different than selecting the Default policy from the Existing policy drop-down. The first option applies only to web category blocking, while the second option uses the settings across all tabs in the Default policy for your new policy.

You can select a policy template only when creating a new policy. Once you have saved your settings for a new policy on the General tab, you cannot select a different template.

To use time-based policy enforcement, select the Time zone where your users are located.

In Internet availability, define any time-based web access controls that you want to use. The default setting is to allow Internet access at all times. For more information, see Internet availability.

If required, define confirm timeouts, quota settings, and search filtering. For more information, see General tab.

If available, define whether your users should see and agree to an Acceptable use policy.

When enabled, use the drop-downs to select the AUP page to use when this policy is enforced and how frequently the notice should display.

Click Save when you are finished.

Testing policy enforcement

Use the Filtering Test section on the Policies page to check how your policies handle a request for a URL. You can also test particular situations that may be causing issues for your end users, such as including a user name or user agent header.

To run the test:

Under Filtering Test, enter the full URL that you want to test, including the http:// or https:// prefix.

Optionally, enter the email address of an end user registered or synchronized with your account.

Specify the Egress point for the test. By default this is the current IP address that you have used to access the cloud portal. You can also use:

Other IP to specify a different IP address that is registered as a proxied connection in one of your policies


	Note If you select Other IP and then enter an IP address that is not associated with your account, an error message results.

Unknown IP to test a roaming user scenario

Edge device or Appliance to test connections forwarded to the cloud by an on-premises network device

If you have defined internal networks for your network device, you can optionally also specify the internal IP address that you want to test.

To identify a particular user agent that may be causing policy enforcement issues, mark Specify user agent header and enter the user agent string in the field provided.

Click Test.

The results popup window displays the following information:

The details that you entered, including the user email address and user agent if defined

The policy applied, as derived from the source IP address that you selected

The category or categories that contain the URL

The action applied to the URL by this policy

Click Close when you are done.

Uploading a policy assignment file

You can automatically assign end users to policies by uploading a file of policy and user information to the cloud service.

Format the CSV file as two columns, with a header row consisting of the words "EmailAddress" and "Policy". The two columns must contain:

An email address belonging to an existing user in your account

A policy name in your account.

For example:

EmailAddress,Policy

address1@domain1.com,Default

address2@domain1.com,Sales Policy

Note that you do not have to include all of your existing users in the file, only those whose policy assignment you wish to change. If a field contains a comma, it must be quoted.

To upload the file:

Under Policy Assignment, browse to the file that you wish to use.

Click Upload.

The email addresses in the file are checked against the existing users in the account, and a confirmation message is displayed once the file has uploaded successfully. If there are errors in the file—for example, incorrect formatting, a non-existent policy name, or an invalid, unknown, or duplicate email address—the upload is canceled and an error message is displayed to explain the problem.

You can also download a CSV file containing the current list of end users assigned to policies by clicking Download existing policy assignments.