Protocol-based policy enforcement

Administrator Help | Forcepoint Web Security and Forcepoint URL Filtering | v8.5.x

Related topics:

Editing custom protocols

Creating a custom protocol

Adding or editing protocol identifiers

Adding to a pre-defined protocol

The Forcepoint URL database includes protocol definitions used to manage Internet protocols other than HTTP, HTTPS and FTP. These definitions include Internet applications and data transfer methods such as those used for instant messaging, streaming media, file sharing, file transfer, Internet mail, and other network and database operations.

These protocol definitions can even be used to manage protocols or applications that bypass a firewall by tunneling through ports normally used by HTTP traffic. Instant messaging data, for example, can enter a network whose firewall blocks instant messaging protocols by tunneling through HTTP ports. Web protection software accurately identifies these protocols, and filters them according to policies you configure.

With Forcepoint Web Security, Content Gateway can be configured to detect non-HTTP protocols that tunnel over HTTP ports. See Configuring tunneled protocol detection for more information. Network Agent can also be used to manage non-HTTP protocols.

In Forcepoint URL Filtering deployments, Network Agent must be installed to enable protocol-based policy enforcement.

How protocol requests are managed

When a protocol request is made, the following steps are used to determine whether to block or permit the request:

Determine the protocol (or Internet application) name.

Identify the protocol based on the request destination address.

If any of this information cannot be determined, all content associated with the protocol is permitted.

If the protocol is FTP, HTTPS, or gopher, a check is first performed to see if the protocol is blocked. If the protocol is permitted, Filtering Service performs a URL lookup to see if the requested site is permitted or blocked.

Defining custom protocols

In addition to using pre-defined protocol definitions, you can define custom protocols. Custom protocol definitions can be based on IP addresses or port numbers, and can be edited.

To block traffic over a specific port, associate that port number with a custom protocol, and then assign that protocol a default action of Block. When ports are used to define a protocol, blocking the port intercepts all Internet content entering your network over that port, regardless of source.


	Note Occasionally, internal network traffic sent over a particular port may not be blocked, even though the protocol using that port is blocked. The protocol may send data via an internal server more quickly than Network Agent can capture and process the data. This does not occur with data originating outside the network.

To work with custom protocol definitions, go to Policy Management > Filter Components, and then click Protocols. See Editing custom protocols and Creating a custom protocol for details.