Fortinet Gate 60D, Руководство администратора

Страница: 486 / 706

URL filter Web Filter
FortiGate Version 4.0 Administration Guide
486 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Figure 315: New URL Filter
URL formats
When adding a URL to the URL filter list (see “Configuring the URL filter list” on
page 485 ), follow these rules:
HTTPS URL formats
If your FortiGate unit does not support SSL content scanning and inspection or if you have
selected the
URL filtering option in a protection profile for HTTPS content filtering mode
under Protocol Recognition , filter HTTPS traffic by entering a top level domain name, for
example,
www.example.com
. HTTPS URL filtering of encrypted sessions works by
extracting the CN from the server certificate during the SSL negotiation. Because the CN
only contains the domain name of the site being accessed, web filtering of encrypted
HTTPS sessions can only filter by domain names.
If your FortiGate unit supports SSL content scanning and inspection and if you have
selected Deep Scan, you can filter HTTPS traffic in the same way as HTTP traffic. For
information about SSL content scanning and inspection, see
“SSL content scanning and
inspection” on page 399 .
HTTP URL formats
• Type a top-level URL or IP address to control access to all pages on a web site. For
example,
www.example.com
or
192.168.144.155
controls access to all pages at
this web site.
• Enter a top-level URL followed by the path and filename to control access to a single
page on a web site. For example,
www.example.com/news.html
or
192.168.144.155/news.html
controls the news page on this web site.
• To control access to all pages with a URL that ends with
example.com
, add
example.com
to the filter list. For example, adding
example.com
controls access to
www.example.com
,
mail.example.com
,
www.finance.example.com
, and so
on.
URL Enter the URL. Do not include http://. For details about URL
formats, see
“URL formats” on page 486 .
Type Select a type from the dropdown list: Simple or Regex (regular
expression).
Action Select an action from the dropdown list: Allow , Block , or Exempt .
An allow match exits the URL filter list and checks the other web
filters.
An exempt match stops all further checking including AV
scanning.
A block match blocks the URL and no further checking will be
done.
Enable Select to enable the URL.