Sonicwall SONICOS 5.8 Content Filtering Service

Content Filtering Service 3.0

This document describes the Content FIltering Service (CFS) 3.0 feature and includes the following sections:

• Overview of New CFS Features — page 1

• Prerequisites for Deployment — page 2

• Application Firewall for CFS — page 2

• CFS 3.0 Policy Management Overview — page 4

• CFS 3.0 Configuration Examples — page 8

Overview of New CFS Features

The latest iteration of the CFS feature allows the administrator to use the power of SonicWALL’s

Application Firewall feature in order to increase create a more powerful and flexible solution.

Note While the new Application Firewall method of CFS management offers more control and

flexibility, the administrator can still choose the previous user/zone management method to perform content filtering. Information on implementing the CFS feature using the previous method can be found in the SonicOS Enhanced Administrator’s Guide.

The CFS 3.0 includes the following updates:

• Application Firewall - is now included as part of the CFS rule creation process.to

implement more granular, flexible and powerful content filter policy control, creating CFS policy allow lists utilizing Application Firewall framework.

• Application Objects - Users/groups, address objects and zones can be assigned for

individual CFS policies.

• Bandwidth Management - CFS specifications can be included in bandwidth management

policies based on CFS website categories. This also allows use of ‘Bandwidth Aggregation’ by adding a per-action bandwidth aggregation method.

• SSL Certificate Common Name - HTTPS Content Filtering is significantly improved by

adding the ability to use an SSL certificate common name, in addition to server IP addresses.

• New CFS Categories - Three new categories (Multimedia, Social Networking, and

Malware) are now included in the CFS list.

Content Filtering Service 3.0

Prerequisites for Deployment

In order to implement CFS 3.0 as described in this document, your network deployment must meet the following hardware/software requirements:

• SonicWALL UTM Appliance running SonicOS 5.6.4 firmware or higher

• Application Firewall License registered to your SonicWALL UTM appliance

• CFS Premium License for CFS version 3.0 registered to your SonicWALL UTM appliance

Application Firewall for CFS

In order to support the new CFS features, the application firewall feature now includes:

• Two new Application Objects (CFS Category List, CFS Allow List) and

• One new Application Firewall Policy (CFS)

Application Objects

CFS Category List – This application object provides a checklist containing all of the

predefined CFS categories which can be used in the application firewall CFS policy. CFS Allow List – This application object provides the ability to match text strings – such as

Website URLs – for use as objects in a policy. The match type can be Exact, Partial, Prefix, or Suffix.

1. Application Firewall/CFS 3.0 are not supported on all hardware/software platforms, please refer to your license management page in MySonicWALL to confirm license availability.

Content Filtering Service 3.0

Application Firewall Policy

CFS Policy Type – When defining an Application Firewall policy, the Application Object drop

down list displays all application objects which have been defined in the previous section as ‘CFS Category List’.

Allowed actions on this policy type include:

–

HTTP Block Page

–

Manage Bandwidth

–

No Action

–

CFS Block Page

–

Packet Monitor

Allowed Zones include:

–

LAN

–

DMZ

–

SSLVPN

–

VPN

–

WLAN

Application Firewall for CFS

Note CFS Message Format Checkbox – By default, messages are logged in Application Firewall

format. This checkbox allows you to log using message format standard for CFS.

Content Filtering Service 3.0

CFS 3.0 Policy Management Overview

When a CFS policy assignment is implemented using the Application Firewall method, it is controlled by Application Firewall CFS policies in the Application Firewall > Policies page instead of by Users and Zones.

While the new Application Firewall method of CFS management offers more control and flexibility, the administrator can still choose the previous user/zone management method to perform content filtering.

This section includes the following sub-sections:

• Bandwidth Management Methods — page 7

• Choosing CFS Policy Management Type — page 6

• Enabling Application Firewall and CFS — page 6

• Bandwidth Management Methods — page 7

The CFS Application Firewall Policy Settings Screen

There are multiple changes/additions to the CFS policy creation window when used in conjunction with Application Firewall. The table and image in this section provide information on Application Firewall interface for CFS.

Content Filtering Service 3.0

CFS 3.0 Policy Management Overview

Feature Function Policy Name A friendly name for the policy. If applying a single policy to

multiple groups, it is often a good idea to include the group name in this field.

Policy Type Select “CFS” to show the content filtering options. Address Address or address group to which this policy is applied. The

default value is “Any”, which is also the most common selection for CFS policies.

Exclusion Address Address or address group to exclude from this policy. The

default value is “None”, which is also the most common selection for CFS policies.

Application Object Select the relevant application object, this object dictates the

type of content which will trigger the policy to be enforced. These objects are user-created in the

Firewall > Match Objects screen.

Action Select the action to perform. These can be pre-defined

actions such as “CFS block page”, or custom actions which you may define in the Firewall > Action Objects screen.

Users/Groups Choose individual users or groups to Include (default: All) or

Exclude (default: None) from this policy.

Schedule Select a specific schedule to dictate when this policy is to be

enforced. The default value is “Always on”.

Enable Logging Select to enable logging of any actions taken on behalf of this

policy. This option is selected by default.

Log Using CFS Message Format

Log Redundancy Filter (seconds)

Select to use the legacy CFS logging format. This option is not selected by default.

Dictates the sensitivity of the log-redundancy filter. Select “Use Global Settings” (default) or enter your own per-policy setting in seconds.

Zone Select a specific zone on which this policy is to be enforced.

The default value is “Any”.

CFS Allow List Select a custom allow list to allow selected resources. The

default value is “None”.

CFS Forbidden List Select a custom forbidden list to deny selected resources.

The default value is “None”.

Enable Safe Search Environment

Select this option to require the strictest filtering on all searches on search engines like Google and Yahoo that offer some form of safe-search filtering. This option is not selected by default.

Content Filtering Service 3.0

+ 11 hidden pages