|
Applicable to version - 10.00 build 302 onwards
Requirement
Block Upload over HTTP and HTTPS
Prerequisite
Web and Application Filter module subscribed
Solution
The entire configuration is to be done from Web Admin console. Access Web Admin console with user having “Administrator” profile.
Follow the below given steps to block upload over HTTP and HTTPS.
Step 1. Enable HTTPS scanning
Please check Cyberoam version before you continue as this is version specific step.
All versions up to 10.00.0302
Log on to Telnet Console and go to option 4, and type the following command: set service-param HTTPS scanning on.
This would enable HTTPS scanning.
For all versions above 10.00.0309, by default HTTPS scanning is enabled, hence go to step 2.
Step 2: Add Web filter policy
Go to Web Filter --> Policy --> Policy and click “Add” button to create a Web Filter Policy “DenyHTTPUpload”.
|
Parameters
|
Value
|
|
Name
|
DenyHTTPUpload
|
|
Template
|
Allow All
Note* - “Allow all” Template is selected to allow entire traffic except HTTP/HTTPS upload
|
|
Enable Reporting
|
Enable
|
Click ‘OK’ button to create a Web Filter Policy.
On successful creation of web filter policy, click ‘Add’ button to add web filter policy rule.
|
Parameters
|
Value
|
|
Category Type
|
Web Category
|
|
Category
|
HTTPUpload
|
|
HTTP and HTTPS Action
|
Deny
|
|
Schedule
|
All the Time
|
Click Add button and the Web Filter policy rule will be created successfully as shown in the below snapshot:
The above Web filter policy when implemented through firewall rule, will block HTTP upload.
Step 3: Add Firewall rule
To block HTTPS upload, Cyberoam needs to inspect SSL content of HTTPS traffic. For this, enable HTTPS scanning through the firewall rule.
Go to Firewall à Rule and click on “Add” button to add firewall rule.
|
Parameters
|
Value
|
|
Name
|
LAN_WAN_AnyTraffic
|
|
Network/Host
|
Any/Any
|
|
Services
|
Any
|
|
Schedule
|
All the time
|
|
Action
|
Accept
|
|
Apply NAT
|
Enable
NAT policy - MASQ
|
|
Web Filter
|
DenyHTTPUpload (created in step 2)
|
|
AV & AS Scanning
|
HTTPS
|
Note:
When SSL content inspection for HTTPS traffic is enabled on Cyberoam, the web browsers will prompt a warning message if the Certificate Authority (CA) for the default certificate used by the Cyberoam SSL inspection is not known by the browser. For this, you need to import Cyberoam SSL Proxy certificate in Internet Explorer and Firefox Mozilla for decryption on SSL Inspection.
Document Version: 1.0- 09/09/2010
| 
