122
Advanced Setup) that will allow Optinet to support HTTPS/SSL filtering. These two options
are HTTP Keep-Alive Mode and Enhanced Bridging Mode (EBM).
HTTP Keep-Alive Mode allows Optinet to use the same connection to send and receive
multiple HTTP requests and responses, as opposed to opening a new connection for every
single HTTP request or response. Using HTTP Keep-Alive Mode is essential for improving
Web performance with HTTPS/SSL Filtering.
EBM allows Optinet to act as a transparent filter. As a transparent filter, Optinet does not
modify the Web request or response beyond what is required for authentication and
identification. EBM also improves the quality of service delivering content at higher
bandwidth and reducing transmission latency. If either of these options is not enabled,
HTTPS/SSL Filtering is not possible.
One last requirement before enabling HTTPS/SSL Filtering is deciding on what options to
use. All HTTPS/SSL filtering is handled by TFRS. However, some of the different
HTTPS/SSL Filtering options will determine what steps need to be performed first. For
example, Full SSL Content Filtering requires additional steps for configuration before
enabling HTTPS/SSL Filtering.
This option utilizes a digital certificate from Optinet similar to ones used by CAs. If you plan
on using Full SSL Content Filtering, you will need to deploy the certificate before enabling
HTTPS/SSL Filtering. Please review the section entitled Installing The Optinet Digital
Certificate.
Enabling SSL Certificate-Based Filtering
Enabling SSL Certificate-Based Content Filtering allows you to filter HTTPS web sites based
only on the certificate name present. You can also select Denied Access Page for SSL
Certificate-Based Content Filtering to present users a redirection page for blocked HTTPS
Web sites as well as Only Allow Trusted Certificate Authorities and Non-expired Certificates.
To do this, you will first select an Internet Usage Rule (IUR).
Click Manage -> Policies & Rules -> Internet Usage Rules -> Default Usage Rules (or
another group’s usage rules). The first step is to alter an IUR for HTTPS/SSL Filtering by
choosing a TFRS that can identify and filter HTTPS traffic. Select the Drop-Down Box for
TFRS and chose a rule set that has SSL Filter as a component. This will then allow you to
access the HTTPS/SSL Filtering tab.
Optinet has three default TFRS that filter HTTPS/SSL traffic. These TFRS are listed below
with their corresponding targets. Please note that these are the default settings for the
TFRS and can be changed or customized based on your needs.
Web Deny IM + Anonymous Proxy Guard + SSL Filter
This TFRS performs content filtering, web logging, spyware scanning, virus scanning for
both HTTP (Web Filter) and HTTPS traffic (SSL Filter). This TFRS also denies all IM Client
conversations (Deny IM) and prohibits HTTP traffic on any port other than port 80 or the
designated proxy ports and SSL traffic on any port other than port 443 (Anonymous Proxy
Guard).
