This article applies to:
Question:
- Why does WebMarshal download material from URLs that are blocked by rules?
- Why do my firewall logs show WebMarshal accessed blocked sites?
- Why does WebMarshal cache blocked material?
- Why does WebMarshal scan upload data that should be blocked?
Information:
WebMarshal rules and site blocking are designed to deny blocked material as configured, for both downloads and uploads. Browsing results for end users are fully controlled by the rules.
Administrators may notice log records that indicate WebMarshal has retrieved or cached some blocked material. This is a result of designed behavior as described below.
Download from blocked URLs
When WebMarshal receives a user download request, the Proxy service retrieves response headers and a small initial portion of the file before calling the Engine to process Standard rules.
This behavior has the following benefits:
- It allows the Standard rules to evaluate conditions such as the file name, file type, data size, and presence of cookies. The rule interface and product behavior is simpler to understand because fewer rule types are required.
- It helps to improve product performance by reducing the number of calls to the rule processing Engine.
- Files or pages are never returned to a user until Standard rules have been fully run. Connection to the external server does not indicate that content was returned to any user. Material blocked by Standard rules will not consume an appreciable amount of bandwidth.
Caching of blocked material
The WebMarshal proxy cache can contain material that was blocked for some or all users. Material is cached when it is retrieved from external sites. Files could be cached even though they are blocked for all users.
- WebMarshal rules are flexible and permission to fulfill a request can depend on the user, time of day, or browsing quota.
- Each request from a user invokes a full check of rules that apply to the user at the time.
- The cache is used only to reduce the need for access to external sites. Presence of a file in the cache does not indicate that it was served to any user.
Scanning of uploaded material
WebMarshal unpacks and scans uploaded material before processing any upload rules. As with downloads, this behavior optimizes the selection and processing of upload rule conditions.