2.5. URL Filtering¶

2.5.1. Overview¶

URL Filtering is a service that controls website access according to the customer’s policies.

This service is used via the SIGs. You need to apply separately for Service Interconnectivity.

2.5.2. Features¶

The following features are available for URL Filtering.

Feature	Overview
**URL Filtering	A feature that controls website access per website category by executing actions according to customer’s policies. URL Filtering filters communication from client (VPN) to the target server segment. The target protocols of this service are HTTP and HTTPS.

HTTPS communication is determined based on the URL in the Common Name of the server certificate.

You can select one of the following actions, per web site category.

Items	Overview
Allow	Allows website access without logging.
Alert	Allows website access and logs URL of access-restricted website.
Continue	If users access websites that are registered in those categories, a warning screen indicating that they have accessed a restricted website is displayed. If users click the “Continue” button on the displayed warning screen, they can access the website in question. Logs URL of access-restricted website.
Block	If users access websites that are registered in those categories, a screen indicating that they have accessed a restricted website is displayed and the website is blocked. The user cannot access the relevant website. Logs URL of access-restricted website.

You can add allowed URLs and blocked URLs as required

Items	Overview
Allowed URL (White List)	From the group of websites that are registered to categories that are set as “Continue” or “Block”, you can specify URLs as exception and allow access. A maximum of 100 URLs can be registered as an allowed URL.
Blocked URL (Black List)	From the group of websites that are registered to categories that are set as “Allow” or “Alert”, you can specify URLs as exception and block access. A maximum of 100 URLs can be registered as a blocked URL.

Analysis Capacity

Maximum traffic volume: 200 Mbps in total of both directions/service
Maximum simultaneous connections: 40,000 sessions/service

Note 1: The above values are best-effort.

Note 2: You can increase the traffic volume up to 1 Gbps, 200,000 sessions (when 5 services used) by applying additional services. When you need the additional service, please contact us in advance.

2.5.3. Restrictions¶

Restrictions relating to IP addresses

In order to connect the SIGs with URL Filtering, you must have two IP address blocks available. If the IP address block is already being used, NTT Com Group might ask you to change it.
NTT Com Group will manage the assigned IP address blocks, and assign IP addresses to the devices that require them.

Restrictions relating to network configuration

If you perform Ping monitoring on the VM, you will require an additional Server Segment for direct connection between vFW/INA and the VM.
Do not connect the target server segments directly to the vFW/INA.

Other restrictions

When the actual traffic volume exceeds the contracted traffic volume, the excess traffic might be discarded.
When the URL in Common Name of the server certificate matches the URL categorized as Block/Continue, the blocking/warning screen is not displayed (it is displayed as a browser error).
When you select “Continue” as an action for a web site categories,
- When you use a proxy server, the “Continue” action is applied only to the communication from the client (VPN) to the proxy server. It is not applied to the communication from the proxy server to the Internet from security standpoint.
- Please add the IP address blocks of the target server segment to the proxy exception setting of a client browser. Otherwise, a warning screen will not be displayed.
- Please set vFW/INA so that the communication addressed to port 6080 of the proxy server passes through it.
- You cannot use port 6080 for service communication which goes through URL Filtering, because port 6080 is used to display a warning screen.
Packets which break TCP/UDP/IP protocol rules or abnormal packets are discarded as a standard function regardless of customer’s configuration.

(Examples)
- When the IP header is cut off in the middle
- When the Port number is 0 (zero)
- When the TCP flag combination is abnormal and others
If devices making up this feature are replaced due to malfunction etc., you will not be able to check device logs or event reports from prior to the replacement via Security Web Portal. In addition, if the active server and the standby server are switched for a redundantly configured device and they are restored without replacing the device, you cannot check the log or the event reports of the period during which the switching occurred from Security Web Portal.
URL Filtering does not guarantee that the URL filtering feature has integrity or accuracy, or is suitable for your use. Furthermore, the suitability of the URL identification algorithms provided by the developers or distributors of the devices making up the URL Filtering feature is not guaranteed.
The following information might be provided to the developers or distributors of the devices making up the URL Filtering feature.
- Configuration information obtained from providing URL filtering
- Information concerning controls etc., for URL filtering
We cannot guarantee recovery from failures that might occur due to incompatibility between URL Filtering and your environment, or failures that occur due to your operations other than those specified by NTT Com group.

2.4. Web Anti-Virus

2.6. Application Filtering