Actions

Administrator Help | Forcepoint Web Security and Forcepoint URL Filtering | v8.5.x

Category and protocol filters assign an action to each category or protocol. Cloud App filters assign an action to cloud applications that are specified in the filter. This is the action that web protection components take in response to a client's Internet request.

The actions that apply to categories, protocols, and cloud applications are:

Block the request. Users receive a block page or block message, and are not able to view the site or use the Internet application.

Permit the request. Users can view the site or use the Internet application.

The actions that apply to both categories and protocols are:

Evaluate current Bandwidth usage before blocking or permitting the request. When this action is enabled, and bandwidth usage reaches a specified threshold, further Internet requests for a specific category or protocol are blocked. See Using Bandwidth Optimizer to manage bandwidth.

Additional actions can be applied only to categories.

Confirm—Users receive a block page, asking them to confirm that the site is being accessed for business purposes. If a user clicks Continue, she can view the site.

Clicking Continue starts a timer. During the configured time period (60 seconds by default), the user can visit other sites in Confirm categories without receiving another block page. Once the time period ends, browsing to any other Confirm site results in another block page.

The default time can be changed on the Settings > General > Filtering page.

Quota—Users receive a block page, asking them whether to use quota time to view the site. If a user clicks Use Quota Time, he can view the site.

Clicking Use Quota Time starts two timers: a quota session timer and a total quota allocation timer.

If the user requests additional quota sites during a default session period (10 minutes by default), he can visit those sites without receiving another block page.

Total quota time is allocated on a daily basis. Once it is used up, each client must wait until the next day to access sites in quota categories. The default daily quota allocation (60 minutes by default) is set on the Settings > General > Filtering page. Daily quota allocations can also be granted to clients on an individual basis. See Using quota time to limit Internet access for more information.


	Important In multiple Filtering Service deployments, State Server is required for correct application of the Confirm and Quota actions. See Policy Server, Filtering Service, and State Server for more information.

Block Keywords: When you define keywords and enable keyword blocking, users requesting a site whose URL contains a blocked keyword are not allowed to access the site. See Keyword-based policy enforcement.

Block File Types: When file type blocking is enabled, users attempting to download a file whose type is blocked receive a block page, and the file is not downloaded. See Managing traffic based on file type.

Permit when user of off-site: Forcepoint Web Security Hybrid Module customers have the option to exclude roaming users from certain policy restrictions, giving them wider Internet access when not in the office.

When Permit when user is off-site is enabled for a specific category, users who would ordinarily be denied access to sites within that category are permitted access when their browsing is done off-site.

For customers with multiple Policy Servers and mixed subscription keys, the Permit when user is off-site option is available only when connected to a Policy Server whose key enables the hybrid service. However, changes made when connected to a Policy Server whose key does not enable the hybrid service impacts the settings for the other Policy Server's categories. For example, if PS1 has a subscription key that enables the hybrid service, but PS2 has a key that does not:

When connected to PS2, if the action applied to a category is changed from permitted to blocked, the same category will appear with the Permit when user is off-site option enabled but unchecked when connected to PS1.

When connected to PS2, if the action applied to a category is changed from blocked to permitted, the same category will appear with the option checked and disabled when connected to PS1.