Configuring Data Filtering

Procedure

1. Choose Object > Security Profiles > Data Filtering.
2. Click Add.
3. Set the name and description of the data filtering profile.

   Parameter	Description
   Name	Name of the data filtering profile. The name must be unique. It will be displayed in the Data Filtering parameter column when you configure a security policy.
   Description	Description of the data filtering profile. A proper description helps you better understand the functions of profiles and facilitates profile selection, lookup, and maintenance. For example, set the description to "Blocks files containing keyword group 1 from uploading through FTP/SFTP".

4. Configure a data filtering rule.
   1. In Data Filtering Profile List, click Add.
   2. Set the name of the data filtering rule.

      Parameter	Description
      Name	Name of the data filtering rule. The name must be unique.

   3. Configure keyword groups in data filtering rules.

      If the traffic matches a data filtering rule, the device checks whether any keyword defined in the data filtering rule exists in the traffic content. If a keyword is identified, the device performs the specified action. If no keyword is identified, the device permits the traffic.

      Parameter

      Description

      Keyword Group

      The keyword group is a set of keywords, including predefined keywords and user-defined keywords. Predefined keywords include bank card numbers, credit card numbers, social security numbers, ID card numbers, mobile phone numbers, and confidentiality keywords. User-defined keywords refer to those that you define for data filtering. For details on how to configure the keyword group, see Configuring a Keyword Group.

   4. Configure the matching conditions of the data filtering rule to determine the files and applications to be filtered.

      The device compares the traffic features with the conditions in the data filtering rule. If all conditions are matched, the traffic matches the data filtering rule. Otherwise, the next rule is compared. If no data filtering rule is matched, the device permits the traffic.

      Parameter	Description
      Application	Specify the protocol or application for data filtering of the files transmitted using the protocol or application.
      File Type	Specify the types of files to implement data filtering.
      Word Boundary	Enable search engine keyword-based exact match. If the function is disabled, the device performs the fuzzy match between the search keyword in the search engine and the keyword specified in the data filtering rule. For example, the search keyword mytest matches keyword test in the data filtering rule, and the action (such as alert and block) of the rule will be taken. After the function is enabled, the device performs the exact match between the search keyword in the search engine and the keyword specified in the data filtering rule. The action (such as alert and block) of the rule will be taken only when the search keyword exactly matches the keyword specified in the rule. NOTE: The function can be configured successfully only when the Search Engine Keywords option is selected in File Type.
      Direction	Specify the file transfer direction to implement data filtering. Upload refers to the direction in which a user sends data from a source address to a destination address, and download refers to the direction in which a user gets data from a destination address to the source address.

   5. Configure the action in the data filtering rule.
      

      • The device does not support blocking NFS. Therefore, in a scenario where Application is set to NFS, and Action is set to Block or the weight is no smaller than Block Threshold, the device takes the alert action.

      • In a scenario where Application is set to IMAP or POP3, and Action is set to Block or the weight is no smaller than Block Threshold:

        • If the email attachment matches the keyword, the device deletes the body and attachment of the email.

        • If the email body matches the keyword, the device deletes the body and attachment of the email.

        • If the email subject matches the keyword, the device deletes the subject, body and attachment of the email.

      Parameter

      Description

      Action

      Action taken by the device when all conditions are matched and keywords are identified. Alert: The device permits the content and generates logs. This is the default action. Block: The device blocks the content and generates logs. By-Threshold: Each keyword has a weight. Weights of all keywords that appear in the detected content are accumulated by count. If the sum of weights is less than the Alert Threshold, the device permits the content. If the sum of weights is greater than or equal to the Alert Threshold and less than the Blocking Threshold, the device performs the alert action once. If the sum of weights is greater than or equal to the Blocking Threshold, the device blocks the content. During data filtering, if the data or application protocol contains the blocked field, the FW pushes a notification page while blocking the data. Push Information in the page can be edited on the FW.

   6. Click OK.
   7. Repeat steps 1 to 6 to create multiple data filtering rules.
5. Click OK to complete the configuration of the data filtering profile.
6. Reference the data filtering profile in the security policy. For details on how to configure the security policy, see Configuring a Security Policy Using the Web UI.
7. Click Commit on the upper right of the web page to commit the profile.

   The created or modified security profile does not take effect immediately. You need to click Commit on the upper right of the web page to activate the configuration. To save time, commit the configuration after you complete all operations on the security profile.