Fortigate部署Web过滤.ppt

* * For the overrides affecting Users and Groups, this will require the user/group to be authenticated before attempting an override. In the above example the site “/products” has been selected for a directory override. The scope of the override is the “FGD-Override” protection profile, and users will not be permitted to access off-site links on the page subject to override. Thus, if a host is subject to the “FGD-Override” profile they will be permitted to access the “/products” site regardless of whether or not the site would be otherwise blocked by the FortiGuard configuration. The override link will not be shown, the user will seamlessly access the site. In the above example the override scope is “User”, this makes the assumption that Firewall Authentication has already occurred. If it has not, when the user clicks the override link on a blocked page an error will be produced stating that the user is not authenticated. Both the “User” and “User Group” scopes require Firewall Authentication. If Firewall Authentication has previously occurred, a page will be displayed prompting the user for a valid login and password for the override group. In the case above, the user would require the login and password of the “trevor” user. If the override scope is “IP” this means the firewall will display the override link for blocked pages that are contained within the categories selected for override. The user will then be prompted for a valid login and password for the override group. In the example above, this would be the “trevor” user from the “override-group” group. Once authenticated, the IP address of the host would be used to allow the user to the selected domain / directory / category. When using override groups it is also possible to select “ask” for the override parameters. This means that the user will have the opportunity to select the override scope, type, off-site URL permissions, and duration. This can produce security issues particularly if the