Networking the WF or WFR in Bridge Mode

This article applies to:

• Web Filter and WFR 5.1.00 and above
• Bridge Mode filtering

Question:

• How do I set up a Web Filter in Bridge mode?

Information:

When the Web Filter is set up in the Bridge mode, it applies special networking rules for HTTPS connections to known Google and YouTube sites.

The list of IP addresses for Google and YouTube sites is published by Google. The Web Filter is updated automatically when the list changes (using a file delivered automatically from Trustwave).

All secure traffic to and from Google and YouTube is redirected through an on-board proxy. This proxy uses a special SSL certificate to decrypt the HTTPS traffic. Web Filter is able to filter the decoded traffic using the same rules that apply to ordinary HTTP requests for these sites.

All other traffic is filtered using the same methods as for Invisible mode. HTTPS traffic to and from sites other than Google and YouTube is not decrypted.

In Bridge mode, the Web Filter is connected in line between the local hub and the external router or firewall. Depending on availability of an expansion slot on the appliance, you may be able to install a special "bypass" network interface card (provided by Trustwave). This card is designed to pass all traffic if the appliance is powered down, to maintain network connectivity.

Configuration Instructions

• For basic information about how to configure the Web Filter in Bridge mode, see the Appliance Installation Guide.

• For a walkthrough of bypass card installation, see the Bypass Card Installation document (provided with the card).

Optimizing Bridge networking

• Use policy routing to ensure that the Web Filter only receives traffic through web filter that needs to be filtered (HTTP and HTTPS traffic, normally ports 80 and 443).
  • Route other traffic (such as SMTP port 25) directly.
  • This reduces the load on the Web Filter. Also, in cases where a bypass card is not installed, all traffic would be blocked if the Web Filter is powered down or unresponsive.

• Configure a static or an asymmetric route in your upstream router so that all incoming traffic goes directly to the LAN. Do not route incoming traffic to the Web Filter.