Creating Content Filtering Profiles
Use the Create Content Filtering Profiles page to configure content filtering profiles. Content filtering blocks or permits certain types of traffic based on the MIME type, file extension, and protocol command. The content filter controls file transfers across the device by checking traffic against configured filter lists. Table 1 displays the types of content filters that you can configure as part of a content filtering profile.
The content filtering profile evaluates traffic before all other UTM profiles. Therefore, if traffic meets criteria configured in the content filter, the content filter acts first upon this traffic.
Table 1: Supported Content Filter Types
MIME pattern filter
MIME patterns are used to identify the type of traffic in HTTP and MAIL protocols. There are two lists of MIME patterns that are used by the content filter to determine the action to be taken. The block MIME list contains a list of MIME type traffic that is to be blocked. The MIME exception list contains MIME patterns that are not to be blocked by the content filter and are generally subsets of items on the block list.
Note: The exception list has a higher priority than the block list.
Block Extension List
Because the name of a file is available during the transfers, using file extensions is a highly practical way to block or allow file transfers. All protocols support the use of the block extension list.
Protocol Command Block and Permit Lists
Different protocols use different commands to communicate between servers and clients. By blocking or allowing certain commands, traffic can be controlled on the protocol command level. The block or permit command lists are intended to be used in combination, with the permit list acting as an exception list to the block list.
Note: If a protocol command appears on both the permit list and the block list, the command is permitted.
To create a content filtering profile:
- Select Configuration > Unified Threat Mgmt > Content
Filtering Profiles in Customer Portal.
The Content Filtering Profiles page appears.
- Click the add icon (+) to create a new content
The Create Content Filtering Profiles wizard appears, displaying brief instructions about creating a content filtering profile.
- Click Next to navigate to the next page.
- Complete the configuration according to the guidelines
provided in Table 2.
Fields marked with * are mandatory.
- Click Finish.
A summary page is displayed. Review the settings and if you need to make any modifications click the Edit link or the Back button.
- Click OK save the settings and create the profile.
A message indicating the status of the create operation is displayed.
- Click Close.
You are returned to the Content Filtering Profiles page.
Table 2: Content Filtering Profile Settings
Enter a unique name for the content filtering profile. The maximum length is 29 characters.
Enter a description for the content filtering profile. The maximum length is 255 characters.
Notify Mail Sender
Select this check box if you want to notify the sender when a failure occurs or a virus is detected. This check box is cleared by default.
Select the type of notification (Protocol or Message) from the drop-down list.
Custom Notification Message
Enter a custom notification message. The maximum length is 512 characters.
Command Block List
Enter the protocol commands to be blocked for the HTTP, FTP, SMTP, IMAP, and POP3 protocols. Use commas to separate each command.
Protocol commands allow you to control traffic at the protocol-command level.
Command Permit List
Enter specific commands to be permitted for the HTTP, FTP, SMTP, IMAP, and POP3 protocols. Use commas to separate each command.
Block Content Type
Use the content filter to block other types of harmful files that the MIME type or the file extension cannot control. Select from the following types of content blocking (supported only for HTTP):
Extension Block List
Use a file extension list to define a set of file extensions to block over HTTP, FTP, SMTP, IMAP, and POP3.
Enter file extensions to block separated by commas. For example, exe, pdf, js, and so on.
MIME Block List
Enter the MIME types you want to block over HTTP, FTP, SMTP, IMAP, and POP3 connections. Use commas to separate each MIME type.
MIME Permit List
Enter the MIME types you want to permit over HTTP, FTP, SMTP, IMAP, and POP3 connections. Use commas to separate each MIME type.