Allied Telesis AR Router Series Quick start guide

Advanced Network Protection
Technical Guide
Feature Overview and Configuration Guide
C613-22104-00 REV B

C613-22104-00 REV B |Page 2
Advanced Network Protection
Acknowledgments
This product includes software developed by the University of California, Berkeley and its
contributors.
Copyright ©1982, 1986, 1990, 1991, 1993 The Regents of the University of California. All rights
reserved.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit.
For information about this see www.openssl.org/. Copyright ©1998-2008 The OpenSSL Project. All
rights reserved.
This product includes software licensed under the GNU General Public License available from:
www.gnu.org/licenses/gpl2.html
Source code for all GPL licensed software in this product can be obtained from the Allied Telesis
GPL Code Download Center at: www.alliedtelesis.com/support/default.aspx
Allied Telesis is committed to meeting the requirements of the open source licenses including the
GNU General Public License (GPL) and will make all required source code available.
If you would like a copy of the GPL source code contained in Allied Telesis products, please send us
a request by registered mail including a check for US$15 to cover production and shipping costs
and a CD with the GPL code will be mailed to you.
GPL Code Request
Allied Telesis Labs (Ltd)
PO Box 8011
Christchurch
New Zealand
©2009 Allied Telesis Inc. All rights reserved. No part of this publication may be reproduced without
prior written permission from Allied Telesis, Inc.
Allied Telesis, Inc. reserves the right to make changes in specifications and other information
contained in this document without prior written notice. The information provided herein is subject to
change without notice. In no event shall Allied Telesis, Inc. be liable for any incidental, special,
indirect, or consequential damages whatsoever, including but not limited to lost profits, arising out of
or related to this manual or the information contained herein, even if Allied Telesis, Inc. has been
advised of, known, or should have known, the possibility of such damages.
Allied Telesis, AlliedWare Plus, Allied Telesis Management Framework, EPSRing, SwitchBlade,
VCStack and VCStack Plus are trademarks or registered trademarks in the United States and
elsewhere of Allied Telesis, Inc. Additional brands, names and products mentioned herein may be
trademarks of their respective companies.

C613-22104-00 REV B |Page 3
Advanced Network Protection
Contents
Introduction........................................................................................................................ 5
Products and Software Versions that apply to this Guide...................................................................6
Related Documents.............................................................................................................................7
Licensing .............................................................................................................................................8
Feature Overview............................................................................................................... 9
Intrusion Prevention System (IPS) .....................................................................................................10
Anti-virus ...........................................................................................................................................13
IP Reputation.....................................................................................................................................14
Malware Protection ...........................................................................................................................16
Web Control.......................................................................................................................................17
URL filtering.......................................................................................................................................20
UTM Offload ......................................................................................................................................22
Selecting a Security Solution.......................................................................................... 24
Proxy Versus Stream-based Security Processing.............................................................................24
Packet Flow Architecture ..................................................................................................................25
Selecting a UTM Firewall...................................................................................................................28
URL Filtering or Web Control? ..........................................................................................................30
Anti-virus or Malware Protection?.....................................................................................................31
Firewall/NAT Rules, Entities and Performance ..................................................................................32
Configuring Intrusion Prevention System (IPS) ............................................................ 34
Configuring Anti-virus ..................................................................................................... 35
Configuring IP Reputation .............................................................................................. 36
Configuring Malware Protection .................................................................................... 37
Configuring Web Control ................................................................................................ 38
How to Configure Basic Web Control ...............................................................................................38
How to Configure Web Control Default Action Per-entity .................................................................40

C613-22104-00 REV B |Page 4
Advanced Network Protection
How to Discover which Web Control Categories Website URLs Belong to......................................42
Configuring Web Control with Firewall Enabled ................................................................................43
Configuring URL filtering ................................................................................................ 45
How to Use URL Filtering..................................................................................................................45
Configuring URL Filtering ..................................................................................................................48
Setting up and Configuring UTM Offload ...................................................................... 53
Setting up UTM Offload ....................................................................................................................53
About the Offload Image ...................................................................................................................55
Configuring UTM Offload on VMware ESXi Server ...........................................................................56
Security Considerations ....................................................................................................................61
Configuring Firewall and NAT allowing UTM Offload on the AR4050S .............................................62
UTM Offload Glossary .......................................................................................................................63
Logging............................................................................................................................. 64
Log Message Filtering—General.......................................................................................................64
Reading Log Messages.....................................................................................................................65
Firewall Log Messages......................................................................................................................65
UTM Log Messages ..........................................................................................................................66
IPS Log Messages ............................................................................................................................67
IP Reputation Log Messages ............................................................................................................68
Malware Protection Log Messages ...................................................................................................68
URL Filtering Log Messages .............................................................................................................69
Web Control Log Messages ..............................................................................................................71
Anti-virus Log Messages...................................................................................................................71
Firewall Connection Logging.............................................................................................................72
UTM Offload Logging ........................................................................................................................74

C613-22104-00 REV B |Page 5
Introduction Advanced Network Protection
Introduction
This guide describes the Advanced Network Protection features on AR-Series UTM firewalls
AR4050S and AR3050S and how to configure them. It also describes the performance effects when
various combinations of advanced security features are in use.
AlliedWare Plus Advanced Network Protection features provide the first line of defense against a
wide range of malicious content. In addition to protecting the local network by blocking threats in
inbound traffic, they also prevent compromised hosts or malicious users from launching attacks.
This is essential for protecting your organization’s reputation.
By partnerships with third-party security specialists, the security features below can be used in
combination with associated signature databases that are regularly updated to keep on top of the
latest attack mechanisms.
Intrusion Prevention System
Anti-virus
Malware Protection
IP Reputation
Web Control
URL Filtering
Additionally, on the AR4050, the UTM Offload feature can be used to improve network forwarding
performance by offloading some of the advanced security features to a second physical or virtual
machine that is automatically managed by the AR4050S.
This document provides:
Overviews of each feature, in "Feature Overview" on page 9
Performance considerations and guidance for choosing which features and combinations may be
appropriate for your network, in "Selecting a Security Solution" on page 24
Guidance for selecting a UTM firewall based on security and performance requirements of your
network, in "Selecting a UTM Firewall" on page 28
How to configure each of the security features, including examples
Descriptions of logging available for each of the security features, in "Logging" on page 64.

C613-22104-00 REV B Products and Software Versions that apply to this Guide |Page 6
Introduction Advanced Network Protection
Products and Software Versions that apply to this Guide
This guide applies to AlliedWare Plus™ products that support Advanced Network Threat Protection
features, running version 5.4.5 and later.
To see whether your AR-Series UTM Firewall supports a particular feature or command, see the
following documents:
The product’s Datasheet
The product’s Command Reference
These documents are available from the above links on our website at alliedtelesis.com.
The features described in this document are supported from AlliedWare Plus 5.4.5 or later as
follows:
Intrusion Prevention System:
Version 5.4.5
Anti-virus:
Version 5.4.5
IP Reputation:
Version 5.4.5
Malware Protection
Version 5.4.5
Web Control
Version 5.4.5 and later support Web Control.
Version 5.4.6-2 and later support Web Control configuration of default action on a per-entity
basis.
Version 5.4.7-1.x and later support categorization of HTTPS websites using Transport Layer
Security Server Name Indication (TLS SNI).
Version 5.4.7-2.x and later supports a command to inquire about the web control category of a
website URL.
URL Filtering
Version 5.4.6-0.x and later support URL Filtering.
Version 5.4.7-1.x and later support:
Logging of all URL requests
URL filtering of HTTPS web sites using Transport Layer Security Server Name Indication (TLS
SNI).

C613-22104-00 REV B Related Documents |Page 7
Introduction Advanced Network Protection
UTM Offload
Version 5.4.8-1.2 supports UTM Offload (AR4050S only).
Logging
Version 5.4.7-1.x assigns facility local5 for all log messages generated by firewall UTM features.
Version 5.4.7-1.x and later support firewall connection logging.
Related Documents
The following documents give more information about related features on AlliedWare Plus products:
The product’s Command Reference
Firewall and Network Address Translation (NAT) Feature Overview and Configuration Guide
Getting Started with the UTM Firewall GUI (AR4050S, AR3050S)
Logging Feature Overview and Configuration Guide
Update Manager Feature Overview and Configuration Guide
Application Awareness Feature and Configuration Overview Guide
Triggers Feature Overview and Configuration Guide
These documents are available from the links above or on our website at alliedtelesis.com
This document is not applicable to Secure VPN routers. For information about Secure VPN
routers, see the AR-Series VPN Router range.

C613-22104-00 REV B Licensing |Page 8
Introduction Advanced Network Protection
Licensing
The AR-Series UTM firewalls have two subscription licensing options for the advanced security
features. The following table shows the features included in those licenses, and whether they are
proxy or stream-based processes:
For information about installing licenses, see the ‘Subscription Licenses’ section of the Licensing
Feature Overview and Configuration Guide.
License Type Features included
Base Intrusion Prevention System (IPS)
Next-Gen Firewall (NGFW) Application Awareness
Web Control
Advanced Threat Protection (ATP) IP Reputation
Malware Protection
Anti-virus
URL Filtering
UTM Offload UTM Offload
■UTM Offload requires an AT-FL-UTM-OFFLOAD-xYR
subscription license. Select from the 1, 3, or 5 year options.
■The UTM Offload feature is installed on the forwarding device
(the AR4050S), rather than the offload device.
■Licenses for the UTM features (IP Reputation, URL Filtering and
Malware Protection) are installed on the forwarding device.
There is no need to get new licenses for the same feature on
the offload device.

C613-22104-00 REV B Licensing |Page 9
Feature Overview Advanced Network Protection
Feature Overview
This section provides a brief description of each of the Advanced Network Protection features
available on the AR-Series UTM firewalls.
Intrusion Prevention System (IPS)
IPS is a stream-based intrusion detection and prevention system that is positioned at the
perimeter of a network and effectively protects the network security. It can monitor, analyze and
log suspicious network activity and proactively prevent malicious threats.
For more information about how it works, see "Intrusion Prevention System (IPS)" on page 10. To
configure this feature, see "Configuring Intrusion Prevention System (IPS)" on page 34.
Anti-virus
Proxy-based Anti-virus provides desktop level protection to prevent known threats from passing
through the network. These threats include but are not limited to: Viruses, Trojans, Worms,
Malware, Spyware, Rootkits, Keyloggers and Botnets.
For more information about how it works, see "Anti-virus" on page 13. To configure this feature,
see "Configuring Anti-virus" on page 35.
IP Reputation
An IP address may have a good or bad reputation. An IP address earns a bad reputation when
suspicious activity, such as spam or viruses originating from that address is detected. AlliedWare
Plus IP Reputation provides an extensive library of IP addresses of negative reputation, with each
IP address being scored, categorized by type of activity. Stream-based AlliedWare Plus IP
Reputation can effectively identify and block malicious threats from entering the network. With
AlliedWare Plus IP Reputation, users can decide with confidence which IP addresses are safe to
allow access into the network.
For more information about how it works, see "IP Reputation" on page 14. To configure this
feature, see "Configuring IP Reputation" on page 36.
Malware Protection
Stream-based Malware Protection scans traffic as it traverses the device real-time for known
malware and blocks the traffic once a threat has been detected.
For more information about how it works, see "Malware Protection" on page 16. To configure this
feature, see "Configuring Malware Protection" on page 37.
Web Control
Proxy-based Web Control offers an easy way to monitor and control the types of websites viewed
by employees. It dynamically assigns URLs to categories, and applies policy to control access
to inappropriate categories of websites.
For more information about how it works, see "Web Control" on page 17. To configure this
feature, see "Configuring Web Control" on page 38.

C613-22104-00 REV B Intrusion Prevention System (IPS) |Page 10
Feature Overview Advanced Network Protection
URL Filtering
Stream-based URL filtering provides a fast, efficient method of controlling access to websites
that are known to be undesirable. It acts on a global basis and should be used when traffic is to
be blocked for everyone on the blacklist, or allowed for selective URLs as configured in a
whitelist.
For more information about how it works, see "URL filtering" on page 20. To configure this
feature, see "Configuring URL filtering" on page 45.
Updating
service files
Some of these features involve a partnership with a third-party security specialist. These specialists
provide algorithmic engines and pattern files to match signatures of known viruses, attack
sequences and the like. The pattern files are frequently updated (some are updated multiple times a
day) and made available for download on the Allied Telesis update server. The AR-Series UTM
firewalls automatically checks the Allied Telesis download server for new updates to pull down.
Perform-
ance
Enabling advanced network protection features significantly increases traffic processing and
therefore CPU load. For information and guidance about the performance and security implications
of enabling these features, and of stream and proxy processing methods, see "Selecting a Security
Solution" on page 24.
On the AR4050S, the UTM Offload feature can improve network forwarding performance by
offloading some of the advanced security feature processing to another virtual or physical machine.
This is automatically managed by the AR4050S. See "UTM Offload" on page 22.
Intrusion Prevention System (IPS)
This feature is supported from AlliedWare Plus version 5.4.5 or later.
AlliedWare Plus Intrusion Prevention System (IPS) inspects inbound and outbound traffic to identify
and log suspicious network activity; it proactively counteracts malicious threats. IPS uses the
Suricata IDS/IPS engine to monitor and compare threats against an IDS database of known threat
signatures.
This section describes how IPS works. To configure this feature, see "Configuring Intrusion
Prevention System (IPS)" on page 34.
AlliedWare Plus IPS monitors inbound and outbound traffic and identifies suspicious or malicious
traffic which may bypass your firewall or could be originating from inside your network.
AlliedWare Plus IPS enhances your network visibility and allows you to control the network by
enforcing compliance with security policy.
AlliedWare Plus IPS is stream-based and there is no delay in detection and prevention. The IPS
engine monitors network traffic and detects malicious activity in real-time by comparing the threat's
characteristics and patterns against known malicious threats stored in a signature database.

C613-22104-00 REV B Intrusion Prevention System (IPS) |Page 11
Feature Overview Advanced Network Protection
Once threats or attacks are detected, the IPS engine can take the following actions:
Alert: generate a log message (default action)
Deny: drop matching packets
The firewall is used in conjunction with the IPS engine. The IPS engine is the first line of defense and
it captures the traffic before it reaches the firewall. The firewall primarily filters predetermined
packets and tracks connection to ensure sessions initiated from the private network are allowed.
AlliedWare Plus IPS supports a set of built-in categories. The categories are listed below:
checksum: Invalid checksums, e.g. IPv4, TCPv4, UDPv4, ICMPv4,TCPv6, UDPv6, ICMPv6.
ftp-bounce: GPL FTP PORT bounce attempt.
gre-decoder events: GRE anomalies, e.g. GRE packet too small, GRE wrong version, GRE v0
recursion control, GRE v0 flags, GRE v0 header too big, GRE v1 checksum present, GRE v1
routing present, GRE v1 strict source route, GRE v1 recursion control.
http-events: HTTP anomalies, e.g. HTTP unknown error, HTTP gzip decompression failed, HTTP
request field missing colon, HTTP response field missing colon, HTTP invalid request chunk len,
HTTP invalid response chunk len, HTTP status 100-Continue already seen, HTTP unable to match
response to request, HTTP invalid server port in request.
icmp-decoder-events: ICMP anomalies, e.g. IPv6 with ICMPv4 header, ICMPv4 packet too small,
ICMPv4 unknown type, ICMPv6 truncated packet, ICMPv6 unknown version.
ip-decoder-events: IPv4 & IPv6 anomalies, e.g. IPv4 packet too small, IPv4 header size too small,
IPv4 wrong IP version, IPv6 packet too small, IPv6 duplicated Routing extension header, IPv6
duplicated Hop-By-Hop Options extension header, IPv6 DSTOPTS only padding, SLL packet too
small, Ethernet packet too small, VLAN header too small, FRAG IPv4 Fragmentation overlap,
FRAG IPv6 Packet size too large, IPv4-in-IPv6 invalid protocol, IPv6-in-IPv6 packet too short.
ppp-decoder-events: PPP anomalies, e.g. PPP packet too small, PPP IPv6 too small, PPP wrong
type, PPPoE wrong code, PPPoE malformed tags.
smtp-events: SMTP anomalies, e.g. SMTP invalid reply, SMTP max reply line len exceeded,
SMTP tls rejected, SMTP data command rejected.
stream-events: TCP anomalies, e.g. 3way handshake with ack in wrong dir, 3way handshake
async wrong sequence, 3way handshake right seq wrong ack evasion, 4way handshake
SYNACK with wrong ACK, STREAM CLOSEWAIT FIN out of window, STREAM ESTABLISHED
SYNACK resend, STREAM FIN invalid ack, STREAM FIN1 ack with wrong seq, STREAM
TIMEWAIT ACK with wrong seq, stream-events TCP packet too small, stream-events TCP
duplicated option).
udp-decoder-events: UDP anomalies, e.g. UDP packet too small, UDP header length too small,
UDP invalid header length.

C613-22104-00 REV B Intrusion Prevention System (IPS) |Page 12
Feature Overview Advanced Network Protection
AlliedWare Plus IPS supports the following key IPS features:
Basic Operation
IPS protection is disabled by default
IPS is deployed in stream mode
IPS processing occurs before the firewall
Configuration
All categories have a default action of alert
The list of categories and their configured actions can be displayed
Category actions can be configured

C613-22104-00 REV B Anti-virus |Page 13
Feature Overview Advanced Network Protection
Anti-virus
This feature is supported from AlliedWare Plus version 5.4.5 or later.
AlliedWare Plus™ Anti-virus provides the first line of defense against a wide range of malicious
content, guarding against threats, such as viruses, Trojans, worms, spyware and adware. In addition
to protecting the local network by blocking threats in inbound traffic, it also prevents compromised
hosts or malicious users from launching attacks. This is essential for protecting your organization’s
reputation.
The scanning is performed by the Kaspersky Anti-virus engine. The signature database used by the
engine containing known threat patterns is regularly updated.
This section describes how AlliedWare Plus™ Anti-virus works. To configure this feature, see
"Configuring Anti-virus" on page 35.
How Anti-virus works
AlliedWare Plus™ Anti-virus uses proxy-based detection to scan traffic. Proxy-based detection can
provide the best detection rate. Proxy-based detection looks for known patterns in the traffic, using
signature analysis. A signature database containing a list of known threat patterns is kept up-to-date
to ensure the effectiveness of the detection. Heuristics analysis is also used to look for suspect
behaviors of executable code and malware. Heuristics analysis can therefore detect unknown
viruses as well as known polymorphic malware, which cannot be identified by using signature
analysis.
When AlliedWare Plus Anti-virus detects a virus, it blocks HTTP responses.
AlliedWare Plus Anti-virus provides the following features:
Scans HTTP responses
Supports Kaspersky Anti-virus
Blocks HTTP responses in which a virus has been detected
Scans packed, compressed or encoded object files
Scans objects up to 10MB in size
Scans 100MB of objects concurrently
Extracts nested files up to 3 levels deep
User configurable action upon scan failure
User configurable action when any limit is exceeded

C613-22104-00 REV B IP Reputation |Page 14
Feature Overview Advanced Network Protection
IP Reputation
This feature is supported from AlliedWare Plus version 5.4.5 or later.
IP Reputation uses Emerging Threats' ET Intelligence to identify and categorize IP addresses that
are known sources of spam, viruses and other malicious activity. This can improve the success of
Intrusion Prevention System (IPS) by reducing false positives. It provides an extra variable to the
prevention decision, which allows rules to be crafted to drop packets only if the reputation exceeds
a chosen threshold.
With real-time threat analysis, and regular updates to reputation lists, IP Reputation delivers
accurate and robust scoring, increasing the precision with which intrusion protection policies can be
applied.
This section describes AlliedWare Plus™ IP Reputation and its configuration. To configure this
feature, see "Configuring IP Reputation" on page 36.
How IP Reputation Works
AlliedWare Plus IP Reputation uses categories, which is a grouping of criteria, to classify the nature
of a host's reputation. For example, IP addresses associated with questionable gaming sites will be
categorized as OnlineGaming.
A host may have a reputation in multiple categories. A score is rated for each IP address and the
score is used to compare to a threshold to determine the action taken upon the IP address.
The reputation of a host changes dynamically. A host may degrade its reputation due to active
engagement in unwanted activity, for example, the host launches a spam campaign. Conversely,
absence of malicious activity will result in improved reputation.
AlliedWare Plus IP Reputation provides compressive IP reputation lists through Emerging Threats
signature database (now part of Proofpoint). Emerging Threats provides an IP Reputation database
downloaded to the device. The database is updated regularly and can deliver the latest information
and scores of identified and potentially harmful IP addresses. Figure 1 shows how AlliedWare Plus
IP Reputation works.

C613-22104-00 REV B IP Reputation |Page 15
Feature Overview Advanced Network Protection
Figure 1: IP Reputation
AlliedWare Plus IP Reputation delivers accurate and robust scoring, ensuring that malicious IP
addresses are identified and strong local policies can be carried out with confidence.
AlliedWare Plus IP Reputation provides the following key features and benefits:
Significantly enhances the ability of device to perform detection and intrusion prevention
Advanced algorithm to reduce the number of false positives
IP Reputation is disabled by default
Supports the Emerging Threats’ ET Intelligence™ Rep List of IPv4 addresses, categories and
reputation scores provided by Proofpoint.
Accurate and detailed information on 200,000+ IP addresses that have been identified as the
source of spam, viruses, and other malicious activity
Over 30 IP Reputation categories
Real-time threat analysis
Checks both the source and destination IP addresses in the packet
User configurable action for each IP Reputation category
Alert action logs the packet and allows the packet to continue
Drop action logs the packet and silently discards the packet
Disable action ignores the IP Reputation category
The default action for each category is alert
IP address A score: 30
IP address B score: 40
IP address C score: 20
Category: spammer
IP address A score: 30
IP address D score: 40
IP address E score: 20
Category: bot
IP address F score: 30
IP address D score: 15
IP address G score: 30
Category: spyware
UTM Device
Threat
Analysis
IP
Reputation
Database
1
2
3
Internet
IP address score
> Threshold
IP address score
Threshold
Action: Pass
4
<
5
Trafc
5
Downloaded&Updated to
Trafc Probes
Action: Alert (default),
Deny, Disable

C613-22104-00 REV B Malware Protection |Page 16
Feature Overview Advanced Network Protection
Malware Protection
AlliedWare Plus Malware Protection is supported from AlliedWare Plus version 5.4.5 or later.
Stream-based Malware Protection scans traffic as it traverses the device real-time for known
malware and blocks the traffic once a threat has been detected.
AlliedWare Plus Malware Protection provides the first line of defense against a wide range of
malicious content. In addition to protecting the local network by blocking threats in inbound traffic, it
also prevents compromised hosts or malicious users from launching attacks. This is essential for
protecting your organization’s reputation.
Stream-based high performance anti-malware technology is employed to protect against the most
dangerous cyber threats. By considering threat characteristics and patterns with heuristics analysis,
unknown zero-day attacks can be prevented, along with server-side malware, web-borne malware,
and other attack types. Detection covers all types of traffic including web, email and instant
messaging.
The Kaspersky anti-malware signature database is updated regularly to keep on top of the latest
attack mechanisms.
This section describes how AlliedWare Plus™ Malware Protection works. To configure this feature,
see "Configuring Malware Protection" on page 37.
How Malware Protection works
AlliedWare Plus Malware Protection uses stream-based detection to scan traffic. A stream engine is
used to extract Layer 7 payload from the stream of traffic passing through the device. The stream
engine looks for known patterns in the traffic, using signature analysis. A signature database
containing a list of known threat patterns is kept up-to-date to ensure the effectiveness of the
detection.
AlliedWare Plus Malware Protection provides the following features:
Detects and blocks known malware by inspecting the traffic stream passing through the device
real-time.
Scans the Layer 7 payloads of packets intercepted by the stream engine
Supports updating resource files
Supports Kaspersky Safestream II Malware byte signatures
Note: AlliedWare Plus Malware Protection also provides MD5 scanning of HTTP and SMTP. Malware
Protection uses stream-based scanning to compare the MD5 hash to values provided by the
Kaspersky Safestream II list of malicious objects. Streams that match the MD5 hash of known
malware will be blocked. POP and IMAP do not use the MD5 hash, and are instead scanned by the
byte-stream process described above.

C613-22104-00 REV B Web Control |Page 17
Feature Overview Advanced Network Protection
Web Control
Web Control is supported in version 5.4.5 or later.
AlliedWare Plus Web Control provides a new level of service for business productivity management,
compliance and web security. It offers an easy way to monitor and control the types of websites
viewed by employees. It stops staff members visiting inappropriate websites that:
Drain their productivity
Contain questionable content
Are bandwidth intensive and hence put a strain on resources
Pose potential security threats to the organization
Web Control provides dynamic URL coverage, assigning websites or pages into around 100
categories, and allowing or blocking website access in real-time.
Once a particular URL has been categorized, the result is cached in the device so that any
subsequent web requests with the same URL can be immediately processed according to the policy
in place.
The Web Control process uses Digital Arts' active rating system.
This section describes AlliedWare Plus Web Control. To configure this feature, see "Configuring Web
Control" on page 38.
How Web Control works
Integrated with Digital Arts’ Active Rating System (ARS), AlliedWare Plus Web Control provides
comprehensive and dynamic website coverage with high accuracy of categorization. AlliedWare
Plus™ Web Control is capable of accurately assigning millions of websites or pages into around 100
categories and allowing or blocking website access in real-time.
AlliedWare Plus Web Control provides the following features:
Categorizes a vast number of websites in multiple languages
Covers millions of the most relevant websites in around 100 categories
Supports multiple categorizations for a single website
Supports management and configuration of categories, rules and website categorization provider
AlliedWare Plus Web Control uses a website classifier engine and caching mechanism to filter HTTP
and HTTPS traffic.
When an HTTP request passes through the device, the associated TCP session transporting the
HTTP data is proxied. The embedded URL of the website is intercepted and sent to the website
classifier engine to retrieve the category the website belongs to.

C613-22104-00 REV B Web Control |Page 18
Feature Overview Advanced Network Protection
In the case of HTTPS, if the server name indicator (SNI) is present in the TLS handshake exchange,
it is extracted and sent to the URL classifier engine for categorization. The SNI only includes the
hostname of the website, not the full path of the URL requested. If no SNI is present, the
categorization will be based on the destination IP address of the request.
The SNI field is contained within the Client Hello message supplied during the TLS handshake when
a client Web browser first attempts to access a secure HTTPS server website. The SNI information is
supplied in clear-text, and represents the domain part of the URL of the HTTPS request. The SNI
field is used by secure Web servers hosting multiple secure websites, and allows a Secure Web
server with a single public IP address to host multiple websites. It allows the Secure Web Server to
supply the correct digital certificate containing the correct domain name(s) to the requesting web
browser client, so that the negotiation of the encrypted connection to Website can proceed.
To categorize the website, the website classifier engine queries Digital Arts’ constantly updated
Active Rating System (ARS) which contains about 100 pre-defined categories. The categorization
provider then returns the category of the website. The website classifier engine also queries the
custom static engine, which can be customized to suit individual business needs. The custom
categorization is used in preference to, and can, override Digital Arts categorization. This means if a
website matches match criteria from custom categories, then the website will not be sent for
categorization by Digital Arts.
Once the website has been categorized, the device can filter the website according to a set of rules
defined per category. The user is unable to visit the blocked website and will get a notification page
if the website is blocked. Conversely, the user can get the resulting page from the website if the
website is allowed.
Categorized websites are cached in the device. The device can check its local cache for a matching
website against the HTTP or HTTPS request passing through it.
The Web Control process operates by determining the URL to which a session is destined, and
consulting with a cloud-based server to check whether this URL may or may not be accessed.
If all of the traffic traversing the device consists of new HTTP 1.1 Get requests, and proxy-based
Web Control is enabled, then TCP connections need to be formed and proxied for each connection
request, and the URLs in the connection requests will be accumulated into bulk categorization
requests, and then sent off to the cloud-based URL categorization service.
And so various external factors, such as
latency of the Internet
response time of the categorization servers in the Cloud
processing of responses
will slow down the overall connections per second for traffic processed via this proxy service.

C613-22104-00 REV B Web Control |Page 19
Feature Overview Advanced Network Protection
Figure 2: Web Control block action
Figure 3: Web Control allow action
URL Policy
Digital Arts
Active Rating System
Router
Web Servers
Users
URL
olicy
REQUEST
X
RESPONSE
URL Policy
Digital Arts
Active Rating System
Router
Web Servers
Users
y
y
URL
REQUEST
RESPONSE

C613-22104-00 REV B URL filtering |Page 20
Feature Overview Advanced Network Protection
URL filtering
This feature is supported in AlliedWare Plus version 5.4.6 or later.
URL filtering provides an option for controlling access to website URLs.
Access to particular websites can be allowed (whitelist) or blocked (blacklist), providing businesses
with simple website access management.
URL filtering blocks all HTTP and HTTPS access to a list of websites or portions of web sites.
A whitelist is a list of URLs that are known to comply with organisational policies.
A blacklist is a list of URLs that are known to violate organisational policies.
Kaspersky is a subscription-based service that classifies websites among dozens of pre-defined
categories of content that will not comply with some organisations' policies. 
If you subscribe to the Kaspersky service, you can create additional blacklists to block extra URLs
or whitelists to allow URLs that the Kaspersky service blocks.
The white and black lists can be from two sources, which can be used simultaneously. You can
specify a short list of websites to control access to (up to 1000 blacklist and 1000 whitelist rules),
and/or subscribe to the blacklist service offered by Kaspersky.
If Kaspersky-sourced lists are being used, the device will automatically download list updates from
the Allied Telesis update server.
URL Filtering provides a fast efficient (stream-based) method of blocking web traffic from locations
that are known to be undesirable. It acts on a global basis and should be used when traffic is to be
blocked for everyone on the blacklist, or allowed for selective URLs as configured in a whitelist.
This contrasts with Web Control, which has finer grained control as URLs are proxied and
categorized and access to websites are controllable on a per-category and per-firewall entity basis.
And since the Web Control service is proxy-based there is increased latency compared to the
(stream-based) URL Filtering service.
It is possible to use Web Control and URL Filtering at the same time. Connections must be permitted
by both URL Filtering and Web Control in order to be allowed through the device. A block action in
either feature will cause a failure to load the web page.
How Does URL Filtering Work?
URL filtering works by sniffing traffic as it traverses the AR-Series firewall and detecting the HTTP
and HTTPS transactions that are taking place. These transactions are then processed, and when an
HTTP Request is detected, the URL in question is compared against the whitelists (if any) and
blacklists configured.
In AlliedWare Plus version 5.4.7-1 and later, the URL Filtering feature includes the ability to filter
SSL-protected websites. For these HTTPS requests, the original URLs are encrypted, therefore they