Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 2 answers
  • Subscribers 29 subscribers
  • Views 952 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web filtering: differences between Web policy of None and Web policy of Allow All

David Hay

I see differences in whether web requests work depending on whether a Web policy of None is used or a Web policy of Allow All is used. So there must be extra things that happen when there is a Web policy of Allow All. Can someone help explain what those things are?

The scenario I have is a specific mobile app not working correctly. By trial and error, I have been able to isolate a simple change in a firewall rule that makes the difference between whether the app works as expected or not.

I have a firewall rule for LAN to WAN traffic where the source IP address is for the mobile device with the app. The rule is for any destination network or service. When the Web policy for the rule is set to None, the app works. When the Web policy for the rule is set to Allow All, the app does not work. None of the other checkboxes under Web filtering are checked. 

Logging is turned on for the rule. But when I use the log viewer I cannot find anything being blocked. I have checked the Firewall, Web filter and  SSL/TLS inspection rules.

Are there other logs I should check? Is there other configuration that comes into effect when the Allow All Web policy is applied?



This thread was automatically locked due to age.
Parents
  • 0

    If web policy is None and Malware scanning is unselected, you cannot turn on proxy mode (WebAdmin will not allow you).  Basically, if you don't want the XG to do anything then it forces it into DPI mode.  If for some reason you want it to go through proxy mode then you'll need to set Allow All.

    In DPI mode, there are several reasons that the XG may want to interpret the HTTP.
    Any web policy except None will cause DPI to look at HTTP.
    Malware scanning will cause DPI to look at HTTP.
    ATP will cause DPI to look at HTTP.

    When DPI looks at HTTP it will enforce the HTTP specification (traffic must conform to what it cab process) and it will log (in Web Filter logs, which will also power reports).  But if there is no reason to look at the HTTP at all then it won't.  So if web policy is None (and no malware or ATP) then web-in-snort DPI will not try to interpret the HTTP at all, will not enforce HTTP spec, and will not log web traffic.

    I am not positive, but that might then enable FastPath for that traffic.

Reply
  • 0

    If web policy is None and Malware scanning is unselected, you cannot turn on proxy mode (WebAdmin will not allow you).  Basically, if you don't want the XG to do anything then it forces it into DPI mode.  If for some reason you want it to go through proxy mode then you'll need to set Allow All.

    In DPI mode, there are several reasons that the XG may want to interpret the HTTP.
    Any web policy except None will cause DPI to look at HTTP.
    Malware scanning will cause DPI to look at HTTP.
    ATP will cause DPI to look at HTTP.

    When DPI looks at HTTP it will enforce the HTTP specification (traffic must conform to what it cab process) and it will log (in Web Filter logs, which will also power reports).  But if there is no reason to look at the HTTP at all then it won't.  So if web policy is None (and no malware or ATP) then web-in-snort DPI will not try to interpret the HTTP at all, will not enforce HTTP spec, and will not log web traffic.

    I am not positive, but that might then enable FastPath for that traffic.

Children
No Data
Unfiltered HTML