Web Filtering: Controlling the Flow

While web filtering provides a company with the ability to limit where users visit on the the Internet, what if some users – managers, guests or whole departments – needed access to these categories or subsets of those categories? What if you still want your users or employees some level of freedom? After all, a happy worker is a productive worker. The flexibility to accommodate a multitude of configurations and situations. One size does not necessarily fit all.

Happily, FortiOS comes in many sizes. There are a options available to meet the needs of various users and at various times of the day.

Beyond the selections of the FortiGuard web services, overrides and custom configurations, are the firewall policies that instruct the FortiGate how to determine which users can see what sites and when.

Within firewall policies, you can use an identity-based approach, where local users and groups or more established LDAP, RADIUS or TACACS+ databases can be referenced.  By setting up users and unique groups, you can create web filtering policies to accommodate unique situations rather than painting web access with a very large corporate brush. With unique user and group options, firewall policies can be set up to request authentication. Before a user can access the specific web policy, they must enter a username and password. Once authenticated, the correct web profile can be applied.

Another possibility, web access policies can also be time-controlled. Where specific policies restrict web access through most of the day, policies can lift these restrictions over the lunch hour or after work to enable employees to view social networking sites and entertainment sites (remember those happy, workers?), yet shut the access off automatically so everyone can get back to work (happy and productive!). Or alternatively, set a time quota for the day for different web categories. Rather than dictating a specific time of the day, allow a total time allotment for the day. Gaming maximums of one hour; social network two hours a day. When the user’s time is up, they can be shut off until the next day.

And when the time is up, the FortiGate includes messages you can customize to let users gently know time is up with a customized message. These messages are stored on the FortiGate in simple HTML.

All of these options make for happy network admins, managers and employees. Further, all surfing actions can also be logged and analyzed. Users’ surfing habits can be monitored and thus filtering fine-tuned. If the FortiGate unit has an integrated storage module – internal hard disk or AMC module, or you use a FortiAnalyzer unit, you can log the web sites visited and generate reports to see what the web site flow is, and even, who the top users are, and adjust your network web filtering policies accordingly to strike a balance of network traffic management.

Read Part I: Cloud-Based FortiGuard Web Filtering Services