Webwasher 6.7.2 System Configuration Guide - McAfee

SYSTEM CONFIGURATION GUIDE
Webwasher
Web Gateway Security
Version 6.7.2

Part Number: 86-0948728-A
All Rights Reserved, Published and Printed in Germany
©2008 Secure Computing Corporation. This document may not, in whole or in part, be copied, photocopied,
reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent
in writing from Secure Computing Corporation. Every effort has been made to ensure the accuracy of this
manual. However, Secure Computing Corporation makes no warranties with respect to this documentation
and disclaims any implied warranties of merchantability and fitness for a particular purpose. Secure Computing
Corporation shall not be liable for any error or for incidental or consequential damages in connection with
the furnishing, performance, or use of this manual or the examples herein. The information in this document
is subject to change without notice. Webwasher, MethodMix, AV PreScan, Live Reporting, Content Reporter,
ContentReporter, Real-Time Classifier are all trademarks or registered trademarks of Secure Computing Corporation
in Germany and/or other countries. Microsoft, Windows NT, Windows 2000 are registered trademarks
of Microsoft Corporation in the United States and/or other countries. McAfee is a business unit of Network
Associates, Inc. CheckPoint, OPSEC, and FireWall-1 are trademarks or registered trademarks of CheckPoint
Software Technologies Ltd. or its affiliates. Sun and Solaris are trademarks or registered trademarks of Sun
Microsystems, Inc. in the United States and other countries. Squid is copyrighted by the University of California,
San Diego. Squid uses some code developed by others. Squid is Free Software, licensed under the terms
of the GNU General Public License. The Mozilla SpiderMonkey and NSPR libraries distributed with Webwasher
are built from the original Mozilla source code, without modifications (MPL section 1.9). The source code is
available under the terms of the Mozilla Public License, Version 1.1. NetCache is a registered trademark of
Network Appliances, Inc. in the United States and other countries. Linux is a registered trademark of Linus
Torvalds. Other product names mentioned in this guide may be trademarks or registered trademarks of their
respective companies and are the sole property of their respective manufacturers.
Secure Computing Corporation
Webwasher – A Secure Computing Brand
Vattmannstrasse 3, 33100 Paderborn, Germany
Phone: +49 5251 8717 000
Fax: +49 5251 8717 311
info@webwasher.com
www.webwasher.com
www.securecomputing.com
European Hotline
Phone: +49 5251 8717 660
US Hotline
Phone: +1 800 700 8328, +1 651 628 1500

Contents
Chapter 1 Introduction ........................................................................................ 1–1
1.1 About This Guide............................................................................. 1–2
1.2 What Else Will You Find in This Introduction? ........................................ 1–2
1.3
1.3.1
1.3.2
1.3.3
Using Webwasher............................................................................
First Level Tabs...............................................................................
Configuring a Sample Setting.............................................................
General Features of the Web Interface.................................................
1–3
1–4
1–5
1–7
1.4
1.4.1
1.4.2
Other Documents ...........................................................................
Documentation on Main Products......................................................
Documentation on Special Products ..................................................
1–11
1–12
1–13
1.5 The Webwasher Web Gateway Security Products ................................ 1–14
Chapter 2 User Management ............................................................................... 2–1
2.1 Overview ....................................................................................... 2–2
2.2
2.2.1
2.2.2
2.2.3
Administrators.................................................................................
Accounts........................................................................................
LDAP/Radius Authentication ..............................................................
Role Definition ..............................................................................
2–2
2–3
2–8
2–10
2.3
2.3.1
2.3.2
2.3.3
2.3.4
Policy Management........................................................................
Concept.......................................................................................
Management ................................................................................
Web Mapping ...............................................................................
E-Mail Mapping .............................................................................
2–15
2–16
2–18
2–20
2–25
2.4
2.4.1
2.4.2
2.4.3
2.4.4
User Database..............................................................................
User Database..............................................................................
Import .........................................................................................
LDAP Synchronization....................................................................
Backup & Restore..........................................................................
2–27
2–28
2–31
2–35
2–41
2.5
2.5.1
Authentication Server .....................................................................
Authentication Server .....................................................................
2–42
2–43
2.6
2.6.1
2.6.2
Windows Domain Membership .........................................................
Windows Domain Membership .........................................................
NTLM Authentication Test................................................................
2–55
2–55
2–60
2.7
2.7.1
2.7.2
Languages ...................................................................................
Languages ...................................................................................
Import Language Pack....................................................................
2–62
2–63
2–69
Chapter 3 Reporting ............................................................................................ 3–1
3.1 Overview ....................................................................................... 3–2
3.2
3.2.1
View Live Reports (For Policy)............................................................
View Live Reports............................................................................
3–2
3–3
3.3
3.3.1
3.3.2
Log File Management.......................................................................
Activate Log Files ...........................................................................
Auto-Rotation................................................................................
3–6
3–7
3–10
i

System Configuration Guide
ii
3.3.3
3.3.4
3.3.5
3.3.6
Auto-Deletion................................................................................
Auto-Pushing................................................................................
Content Reporter...........................................................................
Configuring Log File Processing for SmartReporter...............................
3–13
3–16
3–21
3–22
3.4
3.4.1
View Log Files ..............................................................................
View Log Files ..............................................................................
3–28
3–28
3.5
3.5.1
3.5.2
3.5.3
Live Report Management ................................................................
Report Activation ...........................................................................
Load Reports................................................................................
Anonymization ..............................................................................
3–31
3–32
3–38
3–40
3.6
3.6.1
3.6.2
3.6.3
View Live Reports (Overall Reporting)................................................
View Live Reports..........................................................................
View Load ....................................................................................
System Statistics ...........................................................................
3–41
3–42
3–45
3–46
3.7
3.7.1
4-Eyes-Principle ............................................................................
4-Eyes-Principle ............................................................................
3–47
3–48
3.8
3.8.1
Deanonymization...........................................................................
Deanonymization...........................................................................
3–49
3–49
Chapter 4 Caching ............................................................................................... 4–1
4.1 Overview ....................................................................................... 4–2
4.2
4.2.1
Quick Snapshot...............................................................................
Quick Snapshot...............................................................................
4–2
4–4
4.3
4.3.1
4.3.2
HTTP Caching ................................................................................
HTTP Caching ................................................................................
Cachable Objects List.......................................................................
4–5
4–6
4–8
4.4
4.4.1
4.4.2
Cache Settings..............................................................................
Cache Settings..............................................................................
Cache Rules.................................................................................
4–12
4–12
4–14
4.5
4.5.1
Flush Cache .................................................................................
Flush Cache .................................................................................
4–17
4–18
Chapter 5 Proxies ................................................................................................ 5–1
5.1 Overview ....................................................................................... 5–2
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
HTTP Proxy....................................................................................
Settings .........................................................................................
Next Hop Proxies...........................................................................
Authentication...............................................................................
ICAP Services...............................................................................
Transparent Setup .........................................................................
5–3
5–4
5–13
5–21
5–40
5–47
5.3
5.3.1
5.3.2
5.3.3
5.3.4
HTTPS Proxy................................................................................
Settings .......................................................................................
Next Hop Proxies...........................................................................
Authentication...............................................................................
ICAP Services...............................................................................
5–52
5–53
5–60
5–69
5–74
5.4
5.4.1
5.4.2
5.4.3
5.4.4
FTP Proxy....................................................................................
Settings .......................................................................................
Next Hop Proxies...........................................................................
Authentication...............................................................................
ICAP Services...............................................................................
5–76
5–77
5–83
5–91
5–95
5.5
5.5.1
5.5.2
5.5.3
E-Mail Gateway.............................................................................
Gateway Settings ..........................................................................
ICAP Services..............................................................................
Notifications.................................................................................
5–98
5–99
5–104
5–106

Contents
5.5.4 ESMTP Extensions ....................................................................... 5–109
5.6
5.6.1
5.6.2
5.6.3
Delivery Options...........................................................................
Delivery Options...........................................................................
Routing Rules ..............................................................................
Secure Mail Delivery List................................................................
5–113
5–114
5–117
5–123
5.7
5.7.1
Queue Configuration .....................................................................
Queue Configuration .....................................................................
5–126
5–126
5.8
5.8.1
5.8.2
5.8.3
Relay Protection...........................................................................
Allowed Domains..........................................................................
IP Networks.................................................................................
Recipient LDAP Check ..................................................................
5–128
5–129
5–132
5–135
5.9
5.9.1
5.9.2
5.9.3
5.9.4
5.9.5
5.9.6
Exception Lists.............................................................................
IP White List ................................................................................
IP Black List ................................................................................
Client Domain Black List ................................................................
Sender Black List..........................................................................
Recipient Black List.......................................................................
TrustedSource .............................................................................
5–138
5–138
5–141
5–143
5–146
5–149
5–152
5.10
5.10.1
Load Limits..................................................................................
Load Limits..................................................................................
5–154
5–154
5.11
5.11.1
POP3 Access ..............................................................................
POP3 Access ..............................................................................
5–160
5–160
5.12
5.12.1
5.12.2
5.12.3
5.12.4
ICAP(S) Server ............................................................................
ICAP(S) Server ............................................................................
Server Settings ............................................................................
REQMOD Settings........................................................................
RESPMOD Settings ......................................................................
5–162
5–163
5–166
5–172
5–178
5.13
5.13.1
Progress Indication Methods...........................................................
Progress Indication Methods...........................................................
5–181
5–181
5.14
5.14.1
Own Host Name...........................................................................
Own Host Name...........................................................................
5–186
5–186
5.15
5.15.1
5.15.2
IFP ............................................................................................
Settings ......................................................................................
ICAP Services..............................................................................
5–190
5–191
5–193
5.16
5.16.1
WCCP........................................................................................
WCCP........................................................................................
5–195
5–196
Chapter 6 Configuration ...................................................................................... 6–1
6.1 Overview ....................................................................................... 6–2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
Update Manager..............................................................................
General Options ..............................................................................
URL Filter ....................................................................................
AV Engine ....................................................................................
Spam Filter...................................................................................
Proactive Scanning ........................................................................
CRLs ..........................................................................................
6–3
6–4
6–14
6–19
6–23
6–26
6–29
6.3
6.3.1
6.3.2
6.3.3
Central Management......................................................................
Node Settings ...............................................................................
Master Settings .............................................................................
Site Settings .................................................................................
6–31
6–32
6–40
6–43
6.4
6.4.1
6.4.2
6.4.3
6.4.4
Appliance.....................................................................................
General .......................................................................................
Interfaces.....................................................................................
Routes ........................................................................................
Time and Date ..............................................................................
6–47
6–48
6–50
6–52
6–54
iii

System Configuration Guide
iv
6.4.5
6.4.6
6.4.7
Reboot/Shutdown ..........................................................................
Update ........................................................................................
High Availability.............................................................................
6–57
6–58
6–62
6.5
6.5.1
6.5.2
6.5.3
Web Interfaces..............................................................................
Ports...........................................................................................
Sessions......................................................................................
Dashboard / Quick Snapshots ..........................................................
6–71
6–72
6–79
6–81
6.6
6.6.1
Secure Administration Shell .............................................................
General Settings............................................................................
6–83
6–84
6.7
6.7.1
6.7.2
6.7.3
6.7.4
6.7.5
SNMP Interface.............................................................................
Agent ..........................................................................................
Communities ................................................................................
SNMPv3 Users .............................................................................
Trap Sinks...................................................................................
MIB Browser................................................................................
6–89
6–90
6–94
6–98
6–101
6–103
6.8
6.8.1
Global Command Center................................................................
Global Command Center................................................................
6–106
6–107
6.9
6.9.1
6.9.2
6.9.3
6.9.4
Certificate Management .................................................................
Webwasher Root CA .....................................................................
Private Key Handling.....................................................................
Known Certificate Authorities ..........................................................
Client Certificates .........................................................................
6–110
6–111
6–114
6–118
6–122
6.10
6.10.1
DNS Cache .................................................................................
DNS Cache .................................................................................
6–123
6–124
6.11
6.11.1
6.11.2
6.11.3
6.11.4
Backup & Restore.........................................................................
Configuration ...............................................................................
Error Files ...................................................................................
Share Folder................................................................................
Proxy PAC ..................................................................................
6–125
6–126
6–128
6–130
6–131
6.12
6.12.1
6.12.2
6.12.3
Action Editor................................................................................
Action Editor................................................................................
Notifications.................................................................................
Action Definition ...........................................................................
6–133
6–134
6–137
6–139
6.13
6.13.1
6.13.2
6.13.3
Wizards ......................................................................................
Reporting Configuration .................................................................
Spam Filter Setup.........................................................................
LDAP Configuration ......................................................................
6–145
6–146
6–147
6–148
6.14
6.14.1
6.14.2
6.14.3
6.14.4
6.14.5
Debugging ..................................................................................
Debugging ..................................................................................
Tracing .......................................................................................
Adjust Filter List............................................................................
Analyse Object Filtering .................................................................
E-Mail Troubleshooting ..................................................................
6–149
6–149
6–152
6–153
6–156
6–158

Introduction
Chapter 1
Welcome to the Webwasher® System Configuration Guide. It provides you
with information about how to configure Webwasher features that do not belong
to particular filters, but need to be set in order to run Webwasher as a whole.
Configuring Webwasher to run as a proxy server or as an e-mail gateway are
topics that are dealt with in this guide, as well as user management, reporting
features and update procedures.
1–1

Introduction
1.1
About This Guide
The following overview lists the chapters of this guide and explains briefly what
they are about:
System Configuration Guide – Webwasher Web Gateway Security
Introduction Provides introductory information.
User Management Describes the features that are configured with regard to the users
working with Webwasher.
Reporting Describes the reporting features provided by Webwasher.
Caching Describes the caching features provided by Webwasher.
Proxies Describes how to set up Webwasher for running as a proxy server,
as an e-mail gateway and for communicating with the ICAP server
or using the IFP protocol.
Configuration Describes other system configurations features such as, e. g. the
update manager or the action editor.
1.2
What Else Will You Find in This Introduction?
1–2
In addition to the overview that was given in the previous section, this introduction
also:
• Explains how to handle the Web interface that is provided for using Webwasher,
see 1.3.
• Informs you about the other documents that are provided for users of Webwasher,
see 1.4.
• Provides a list of the Webwasher Web Gateway Security products and
gives a brief description for each of them, see 1.5.

1.3
Using Webwasher
Introduction
A user-friendly, task-oriented Web interface has been designed for handling
the Webwasher features. It looks like this:
The following sections provide some information to make you familiar with this
interface. These sections:
• List the first level tabs of this interface and explain their meanings, see
1.3.1.
• Describe a sample procedure showing how a setting is configured for a
Webwasher feature, see 1.3.2.
• Explain more about the general features of this interface, see 1.3.3.
1–3

Introduction
1.3.1
First Level Tabs
1–4
The Web interface displays a number of tabs and sections for configuring the
features provided by Webwasher. On the topmost level, there are these eleven
tabs:
• Home, Common, URL Filter, Anti Malware, Anti Spam, SSL Scanner, User
Management, Reporting, Caching, Proxies, and Configuration
Only the tabs mentioned in the following are described in this guide.
User Management, Reporting, Caching, Proxies, Configuration –
These are tabs for configuring features that adapt Webwasher to the system
environment it is running in.
Note that the Caching tab and feature are only available with appliance versions
of Webwasher.
The following tabs are not described in this document:
Home, Common – These tabs are for configuring basic and other features
that are used by each of the Webwasher products, e. g. system alerts, licensing
features, media type filters, etc.
They are described in each of the User’s Guides.
URL Filter, Anti Malware, Anti Spam, SSL Scanner – These tabs are
for configuring the features of the individual Webwasher products. Note that
the Anti Malware tab is used for both the Webwasher Anti-Malware and the
Webwasher Anti-Virus product.
For a description of these tabs, see the corresponding User’s Guides.

1.3.2
Configuring a Sample Setting
Introduction
This section explains how to configure a sample setting of a Webwasher feature.
The feature chosen here for explanation is Timeout Prevention.
In order to avoid timeouts on the connections to its clients, Webwasher can
send data lines in certain intervals.
For this sample setting, just suppose you want to enable this feature for HTTP
connections and send an empty line every 15 seconds.
The following overview shows the main steps you need to complete in order to
configure the feature in this way:
Configuring Timeout Prevention – Overview
Step 1 Navigate to the section.
2 Configure settings.
3 Make settings effective.
In more detail, these steps include the following activities:
1. Navigate to the section
a. Select the Proxies tab:
b. In the navigation area on the left, select HTTP Proxy, which is located
under Web Proxies:
c. From the tabs provided for configuring the HTTP Proxy options, select
the Settings tab:
1–5

Introduction
1–6
The Timeout Prevention section is located on this tab:
2. Configure settings
a. Enable the feature. To do this, mark the checkbox next to the section
heading.
b. Enter 15 in the input field labeled Webwasher should send every
... seconds.
c. Check the radio button labeled an empty line.
Note: To get help information on these settings, click on the question
mark in the top right corner of the section.
The section should now look like this:
3. Make settings effective
Click on the Apply Changes button:
This completes the sample configuration.

1.3.3
General Features of the Web Interface
Introduction
This section explains more about the features that are provided in the Web
interface for solving general tasks, e. g. applying changes to the Webwasher
settings or searching for a term on the tabs of the interface.
The following features are explained here:
• Apply Changes
• Click History
• Information Update
• Logout
• Main Feature Enabling
• Search
• Session Length
• System Information
Apply Changes
After modifying the settings in one or more of the sections on a tab, you need to
click on the Apply Changes button to make effective what you have modified.
The Apply Changes button is located in the top right corner of the Web interface
area:
When modifying settings that belong only to a particular filtering policy, you can
make the modified settings apply to all policies nevertheless.
An arrow is displayed next to the Apply Changes button on each tab where
policy-dependent settings can be configured:
Clicking on this arrow will display a button, which you can use to apply changes
to all policies.
After clicking on this button, your modifications will be valid for settings of all
policies.
1–7

Introduction
1–8
When you are attempting to leave a tab after modifying its settings, but without
clicking on Apply Changes, an alert is displayed to remind you to save your
changes:
Answer the alert by clicking Yes or No according to what you intend to do about
your changes. This will take you to the tab you invoked before the alert was
displayed.
Clicking on Cancel will make the alert disappear, so you can continue your
configuration activities on the current tab.
Click History
The tabs you visited while configuring settings are recorded on the top left
corner of the Web interface area. They are recorded together with the paths
leading to them.
The current tab and path are always visible in the display field, e. g.:
Clicking on the arrow to the right of the path display will show the “click history”,
i. e. a list of the tabs you visited prior to this one:
Clicking on any of the entries displayed in the list will take you to the corresponding
tab.
The click history is only recorded for the current session, i. e. until you log out.
After logging in for a new session, the recording of tabs and paths will start all
over again.

Information Update
Introduction
Some parts of the information that is provided on the tabs of the Web interface
will change from time to time. In these cases, the information display is updated
automatically every three seconds by Webwasher.
So, e. g. you might have performed a manual update of the anti-virus engines.
This means that the information provided in the Current Status and Log File
Content sections on the corresponding AV Engine tab will begin to change
continuously over a certain period of time until the update is completed.
These sections are then updated automatically every three seconds to reflect
the status of the update process.
Logout
To logout from a Webwasher session, click on the logout link, which is located
in middle position at the top of the Web interface area.
After logging out, the login page is displayed, where you can login again and
start a new session.
Main Feature Enabling
There are Webwasher settings that cannot only be modified if a corresponding
main feature is disabled. So, e. g. if you want to modify the settings of the
Phishing Filter section on the Settings tab under Anti-Spam > Message
Filters, you need to make sure the Message Filter feature itself is also enabled.
If you attempt to modify settings while the corresponding main feature is not
enabled, an alert is displayed to make you aware of this situation:
1–9

Introduction
1–10
Search
A Search input field and button are located in the top right corner of the Web
interface area.
Using these, you can start keyword queries of the entire Web interface by entering
a search term in the input field and clicking on the Search button:
The search output will be presented in a separate window, which displays a
list of the tabs the search term was found on and the paths leading to them:
Clicking on any of the entries displayed in the list will take you to the corresponding
tab.
Note: In order to be able to use the search function, make sure JavaScript is
enabled.
Session Length
When working with the Web interface, you need to mind the session length.
This interval can be configured in the Session Options section of the Sessions
tab under Configuration > Web Interfaces.

1.4
Introduction
After modifying the interval specified there, click on Apply Changes to make
the modification effective.
When a session has timed out, the following notification is displayed:
Click OK to acknowledge the notification. After clicking on a tab or button of
the Web interface, the login window opens, where you can login again and
start a new session.
System Information
At the top of the Web interface area, system information is provided on the
current Webwasher session. This information includes:
• Version and build of the Webwasher software
• Name of the system Webwasher is running on
• Name of the user logged in for the current session, e. g. Admin
• Role assigned to this user, e. g. Super Administrator
• Permissions granted to this user, e. g. read/write
Other Documents
This guide belongs to a series of documents provided for users of the
Webwasher Web Gateway Security products. The following sections give an
overview of them.
The Webwasher user documentation can be viewed after navigating to the
Manuals tab of the Web interface.
It can also be viewed on the Webwasher Extranet and in the Secure Computing
Resource Center.
1–11

Introduction
The following is provided in this section for the Webwasher Web Gateway Security
products:
• An overview of the documents on the main products, see 1.4.1
• An overview of the documents on products for special tasks and environments,
see 1.4.2
1.4.1
Documentation on Main Products
1–12
This section introduces the user documentation on the main Webwasher Web
Gateway Security products.
Document Group Document Name What about?
General Documents Deployment Planning Guide Is Webwasher suited to my environment?
Installation Guide How to install Webwasher?
Quick Configuration Guide First steps to get Webwasher
running.
System Configuration Guide
– this document
Advanced Configuration
Guide
Features for configuring Webwasher
within the system environment.
More sophisticated configuration
tasks.
Upgrade Guide What should I know when upgrading
to a new Webwasher release?
Product Documents User’s Guide URL Filter Features for configuring URL filtering
policies.
Reference Document
User’s Guide Anti-Virus Features for configuring anti-virus
filtering policies.
User’s Guide Anti-Malware Features for configuring
anti-malware filtering policies.
User’s Guide Anti-Spam Features for configuring anti-spam
filtering policies.
User’s Guide SSL Scanner Features for configuring
SSL-encrypted traffic filtering
policies.
Reference Guide Items concerning more than product,
e. g. features for customizing actions
or log files.

1.4.2
Documentation on Special Products
Introduction
This section introduces the user documentation on the Webwasher Web Gateway
Security products for special tasks and environments.
Document Group Document Name What about?
Content Reporter
Documents
Instant Message
Filter Documents
Special Environment
Documents
Appliances
Documents
Content Reporter Installation
and Configuration Guide
Content Reporter User’s
Guide for Reporting
Instant Message Filter
Installation and Configuration
Guide
User’s Guide Instant
Message Filter
Setting Up Webwasher on
Microsoft ISA Server
Setting Up Webwasher with
Blue Coat
Setting Up NetCache with
ICAP
Installing and configuring the
Webwasher Content Reporter, which
is done separately from the main
products.
Creating reports.
Installing and configuring the
Webwasher Instant Message Filter,
which is done separately from the
main products.
Description of features.
Setting up Webwasher or a
product running with it in a special
environment.
See above.
See above.
NTML Agent Set-up Guide Setting up an additional Webwasher
product to enable authentication
using the NTLM method on platforms
other than Windows.
HSM Agent Set-up Guide Setting up an additional Webwasher
product to enable use of a HSM
(High Security Module) device.
Appliances Installation and
Configuration Guide
Installing and configuring the
Webwasher appliances.
Appliances Upgrade Guide What should I know when upgrading
to a new release of the Webwasher
appliances?
1–13

Introduction
1.5
The Webwasher Web Gateway Security Products
1–14
The Webwasher Web Gateway Security products provide an optimal solution
for all your needs in the field of Web gateway security.
They are unique in that they offer best-of-breed security solutions for individual
threats and at the same time a fully integrated architecture that affords in-depth
security and cost/time savings through inter-operability.
A brief description of these products is given in the following.
Webwasher®
URL Filter
Webwasher®
Anti-Virus
Webwasher®
Anti-Malware
Webwasher®
Anti-Spam
Webwasher®
SSL Scanner
Helps you boost productivity by reducing non-business related
surfing to a minimum, thus curbing your IT costs. Suppresses
offensive sites and prevents downloads of inappropriate files, thus
minimizing risks of legal liabilities.
Combines the strength of multiple anti-virus engines concurrently
scanning all Web and e-mail traffic. The Proactive Scanning
filtering technology additionally detects and blocks unknown
malicious code, not relying on time-delayed virus pattern updates.
This combination provides in-depth security against a multitude of
threats while offering unmatched performance through use of the
Anti-Virus PreScan technology.
Offers in-depth security against all kinds of malicious code, such
as aggressive viruses, potentially unwanted programs, spyware,
day-zero attacks and blended threats not covered by traditional
anti-virus and firewall solutions. The highly efficient anti-malware
engine is used in combination with the Proactive Scanning filtering
technology.
Offers complete protection of the central Internet gateway. The
highly accurate spam detection filters stem the flood of unwanted
spam mail before it reaches the user’s desktop. Your systems
will not be impaired, the availability of valuable internal mail
infrastructures, such as group servers, is thus maintained.
Helps you protect your network against attacks via the HTTPS
protocol and prevents the disclosure of confidential corporate data,
as well as infringements of Internet usage policies, thus ensuring
that no one is illicitly sharing sensitive corporate materials.
See next page

Introduction
These two products have their own user interfaces, which are described in the
corresponding documents:
Webwasher®
Content
Reporter
Features a library of rich, customizable reports based on built-in
cache, streaming media, e-mail activity, Internet access and
content filtering queries, all supported by unmatched convenience
and performance features.
Webwasher® Detects, reports and selectively blocks the unauthorized use
Instant of high-risk and evasive P2P and IM from enterprise networks
Message Filter and scans network traffic for characteristics that match the
corresponding protocol signatures.
1–15

User Management
Chapter 2
The functions described in this chapter are accessible over the User
Management tab of the Web interface:
The user management functions allow you to administer users with regard to
the permissions they are granted for configuring and operating Webwasher.
Furthermore, they allow you to map users to the various security policies that
have been set up under Webwasher and configure authentication and language
settings for users.
The upcoming sections describe how to handle these functions. The description
begins with an overview.
2–1

User Management
2.1
Overview
2.2
The following overview shows the sections that are in this chapter:
System Configuration Guide – Webwasher Web Gateway Security
Introduction
User Management Overview –thissection
Reporting
Caching
Proxies
Configuration
Administrators
2–2
Administrators, see 2.2
Policy Management, see 2.3
User Database, see 2.4
Authentication Server, see 2.5
Windows Domain Membership, see 2.6
Languages, see 2.7
The Administrators options are invoked by clicking on the corresponding button
under User Management:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Accounts, see 2.2.1
• LDAP/Radius Authentication, see2.2.2
• Role Definition, see 2.2.3

2.2.1
Accounts
The Accounts tab looks like this:
There is one section on this tab:
• Account Overview
It is described in the following.
User Management
2–3

User Management
2–4
Account Overview
The Account Overview section looks like this:
Using this section you can configure accounts for administrators and assign
different rights and access privileges to them.
To add an account to the list, use the area labeled:
• Define new account
Specify the information concerning an account using the following items:
— Login
In this input field, enter the login name for an administrator.
— Password
In this input field, enter the password the administrator is to submit.
— Role
From this drop-down list, select the role that is assigned to an administrator.
You can select from the roles that are available for you under
your current role. Only these roles are shown here.
The pre-configured roles, which are Super Administrator, Policy
Administrator and Administrator, cannot be modified.
Go to the Role Definition tab to view the permissions for the preconfigured
roles and create or edit user-configured roles, see 2.2.3.

— SSH Public Key
User Management
In this input field, enter the SSH Public Key assigned to an administrator.
To do this, click on the Browse button next to this field and browse
for the key file you want to specify here.
— Allowed policies
From this drop-down list, select the policy that the administrator is allowed
access to. Select All to allow access to all policies.
Note that you can only select policies that you have access to yourself,
according to your account settings. Only these policies are shown here.
— Read only
Mark this checkbox to allow only reading access to Webwasher for an
administrator.
• Add New Account
After specifying the appropriate values for the new account, click on this
button to add it to the list.
If this action was successful, the account is added to the list, which is displayed
at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard. If the number of entries is higher than this number,
the remaining entries are shown on successive pages.
A page indicator is then displayed, where you can select a particular page by
clicking on the appropriate arrow symbols.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field of the Account or Role column or
in both and enter it using the Enter key of your keyboard. The list will then
display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
To view and edit an account, click on the View + Edit Details button next to
it.
2–5

User Management
2–6
This will open a window where you can edit the settings that have been configured
for the various accounts:
For the meaning of these settings, see the description that was given at the
beginning of this subsection.
An additional description of the Account Preferences section of this windows
is provided further below in this subsection.
After editing the account settings, click on Apply Changes to make your
changes effective.
With an account that has been assigned one of the pre-configured roles, e.
g. Super Administrator, you can only change its password. Click on the
Change Password button next to it, to open the editing window and perform
this change.
The meaning of the settings in the Account Preferences settings is described
in the following.

Account Preferences
User Management
Using this section, you can configure the preferred settings for an administrator
account.
After modifying these settings, click on Apply Changes to make the modification
effective.
Use the following checkboxes to configure the preferred settings:
• Read only
Mark this checkbox to configure a read-only permission.
• View web related settings
To have only Web-related settings displayed, make sure this checkbox is
marked. The checkbox is marked by default.
• View mail related settings
To have only mail-related settings displayed, make sure this checkbox is
marked. The checkbox is marked by default.
• Show change warner dialog
If you want to have a dialog window displayed that warns you to save your
changes after modifying any settings, make sure this checkbox is marked.
The checkbox is marked by default.
• Show configuration hash
Mark this checkbox to have the hash value for the current configuration
displayed in the system information lines at the top of the Web interface
display area.
• No LDAP/Radius check (only local password check)
If no LDAP or Radius authentication should be required for the administrator
login, mark this checkbox. Submitting the locally configured password
will then be sufficient for accessing Webwasher.
This setting may be used to configure an administrator account that is available
for login whenever the LDAP or Radius servers are down.
2–7

User Management
2.2.2
LDAP/Radius Authentication
2–8
The LDAP/Radius Authentication tab looks like this:
There are two sections on this tab:
• Use LDAP to Authenticate Administrator
• Use Radius to Authenticate Administrator
They are described in the following.
Use LDAP to Authenticate Administrator
The Use LDAP to Authenticate Administrator section looks like this:
It allows you to use the settings stored on an LDAP server for authenticating
an administrator.
If you want to use this feature, mark the checkbox next to the section heading.
Then configure the items described below and click on Apply Changes to
make your settings effective.

User Management
Use the following items to configure the use of the LDAP server settings for
administrator authentication:
• Use LDAP settings for HTTP Proxy
If you want to use the LDAP server settings with Webwasher configured
as HTTP proxy, make sure this radio button is checked. The radio button
is checked by default.
• Use LDAP settings for ICAP server
Click on this radio button to use the LDAP server settings with Webwasher
configured as ICAP server.
• Check Status
To view status information on the LDAP server settings, click on this button.
This may be information, e. g. on whether a connection to an LDAP server
has been configured or whether the server is available.
• Use local account definition if LDAP authentication fails
Mark this checkbox at the bottom of the tab to use local account information
for authenticating an administrator in case LDAP and Radius authentication
both fail.
Use Radius to Authenticate Administrator
The Use Radius to Authenticate Administrator section looks like this:
This section allows you to use the settings stored on a Radius server for authenticating
an administrator.
If you want to use this kind of authentication, mark the checkbox next to the
section heading and click on Apply Changes to make this setting effective.
To go to the page where the Radius server settings are configured, click on the
Define Proxy Authentication Options button provided here.
Mark the checkbox at the bottom of the tab to use local account information for
authenticating an administrator in case LDAP and Radius authentication both
fail.
2–9

User Management
2.2.3
Role Definition
2–10
The Role Definition tab looks like this:
There is one section on this tab:
• Role Definition Editor
It is described in the following.

Role Definition Editor
The Role Definition Editor section looks like this:
User Management
Using this section you can view the role permissions assigned to the administrator
roles that are pre-configured within Webwasher, as well as create and
edit new roles.
To create a new administrator role, use the items provided in the following area:
• Create role
The meaning and usage of these items is as follows:
— New role name
In this input field, enter the name of the new role you want to create.
The name must begin with an alphabetical character (A-Z). The number
of the following characters is not prescribed. However, only alphabetical
and numerical characters, dashes, underscores, and spaces are
allowed here.
— Role to duplicate
If you want to use an existing role as starting point for your configuration
of a new role, select one from the drop-down list provided here.
— Create Role
After entering a role name, click on this button to add the new role to
the roles list. Also, if you have selected and renamed an existing role
as starting point, click on this button to add the role to the list.
2–11

User Management
2–12
The administrator roles list is displayed at the bottom of the section. You can
view and edit the roles contained in this list, with the exception of the three
pre-configured roles, i. e. Super Administrator, Administrator and Policy
Administrator. These you can only view.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
Use the following items to perform other activities relating to the list:
• Filter
Type a filtering term in the input field of the Role column and enter it using
the Enter key of your keyboard. The list will then display only entries
matching the filter.
• View Role Permissions
Click on this button, which is provided for each of the three pre-configured
roles, to view the permissions assigned to any of them.
This will open a window where the permissions are displayed.
For a description of this window, see the subsection further below.
• Edit Role Permissions
Click on this, button, which is provided for each user-configured role, to
view and edit the permissions assigned to any of them.
This will open a window where the permissions are displayed and can be
edited.
For a description of this window. see the subsection further below.
• Delete Selected
Select the role you wish to delete by marking the Select checkbox next to
it and click on this button. You can delete more than one role in one go,
but not any of the three pre-configured roles.
To delete all user-configured roles, mark the Select all checkbox and click
on this button.

Role Permissions Window
The Role Permissions window looks like this:
User Management
Note that this is the version for viewing and editing permissions. The version
for viewing only has no Save button in the top right corner.
By default, all permissions that can be configured in this window are granted.
The seniority level is by default set to 100.
To deny or grant a permission for the role you are configuring, clear or mark
the corresponding checkbox. Then click on the Save button to make the modification
effective.
For further information on what it means to configure the seniority level, as well
as allowed other roles, see the next subsections.
2–13

User Management
2–14
Seniority
The seniority level is measured by a value between 0 and 100.
It is important for determining who can deny access privileges to another administrator
while being logged in a the same time. As an administrator, you
can only deny privileges to administrators with seniority levels lower than your
own level.
So, if your seniority level is 80 and two other administrators are logged in with
seniority levels of 60 and 50, you can deny them simultaneous access or restrict
it to read-only. If an administrator with a seniority level of 100 is logged
in at the same time, you cannot deny this administrator anything. This administrator
may, however, exclude you from reading or writing or from both.
Note that there are three pre-configured roles with administrator levels of 100,
80 and 50, respectively. These pre-configured roles cannot be changed or
deleted. To view the seniority levels and other permissions for these roles,
click on the View Role Permissions button next to the role in question.
The permissions for administrators who are logged in at the same time are
configured using the Access Permissions sectiononthePreferences tab
under Home > Preferences.
After specifying the appropriate value here, click on the Save button in the top
right corner of the window to make this setting effective.
Use the following input field to configure the seniority level for an administrator
role:
• Seniority
Enter a value between 0 and 100 here according to the level required for
this role.
Allowed other roles
This section allows you to configure the roles that can be assigned to another
user account by a user with this role.
So, e. g. if the Administrator role is assigned to a user account and Administrator
and Policy Administrator are configured as allowed other roles
for this role, the user in question can only assign one of these two roles when
creating a new user account.
The user cannot, in this case, assign the Super Administrator role to the
account, or any other role that may be listed in this section, but is not selected.

User Management
To configure a role as allowed for being assigned by this role, select it in the
list by marking the corresponding checkbox.
After configuring all other settings in the Permissions for role ... window as
required, click on the Save button in the top right corner to make your settings
effective.
This will also close the window.
2.3
Policy Management
The Policy Management options are invoked by clicking on the corresponding
button under User Management:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Concept, see 2.3.1
• Management, see 2.3.2
• Web Mapping, see 2.3.3
• E-Mail Mapping, see 2.3.4
2–15

User Management
2.3.1
Concept
2–16
The Concept tab looks like this:
There is one section on this tab:
• Policy Concept
It is described in the following.

Policy Concept
User Management
The Policy Concept section looks uses several textst and a diagram to explain
the concept underlying the Webwasher policy management.
The diagram looks like this:
Using visual means, it represents the threefold structure of policy management
as it is performed under Webwasher:
• Selecting input
• Performingalookup
• Mapping to policy
2–17

User Management
2.3.2
Management
2–18
The Management tab looks like this:
There are three sections on this tab:
• Modify Policy
• Create New Policy
• Duplicate Policy
They are described in the following.
Modify Policy
The Modify Policy section looks like this:
It allows you to reset the settings of an existing policy to their default values
and to delete policies altogether.

User Management
To perform these activities for a policy, select it from the drop-down list provided
here and click on one of the following buttons:
• Reset to default
Click on this button to reset the selected policy to its default values.
• Delete Policy
Click on this button to delete the selected policy.
Create New Policy
The Create New Policy section looks like this:
Using this section, you can begin to configure a new policy by creating it first.
To configure settings for this policy use the tabs provided by this Web interface
for virus scanning, spam filtering, etc. Together with these tabs, policy lists are
provided, which will also include the new policy.
Select it from these lists when you are configuring the various settings, to make
sure they become part of this policy.
Use the following items to create a new policy:
• New policy name
Enter the name for the new policy in this input field. Then click on the
Create button next to it.
The new policy will then appear on the policy lists that are provided on the
tabs for configuring policy-dependent settings.
Duplicate Policy
The Duplicate Policy section looks like this:
2–19

User Management
Using this section, you can configure a new policy by duplicating an existing
one first and taking it as the starting point for configuring further settings.
2.3.3
Web Mapping
2–20
Use the following items to duplicate an existing policy:
• Policy to duplicate
From this drop-down list, select the policy you want to duplicate.
• New policy name
Enter the new name here you want to give the duplicated policy. Then click
on the Duplicate button next to it.
The duplicated new policy will then appear under its new name on the policy
lists that are provided on the tabs for configuring policy-dependent settings.
The Web Mapping tab looks like this:

There are three sections on this tab:
• Mapping Process
• Mapping Options
• Mapping Cache
They are described in the following.
Mapping Process
The Mapping Process section looks like this:
User Management
Using this section, you can configure mapping rules to assign policies to ICAP
requests received in Web communication according to the user information
provided in these requests.
To retrieve this information, various methods are applied, e. g. processing the
user name or, the name of the user group, or the IP address.
Furthermore, a lookup on an LDAP or NTLM server, or on a Novell eDirectory
server can be configured with some methods.
2–21

User Management
2–22
You can also configure the use of an emergency policy that will overrule all
mapping rules configured here in case of an emergency, e. g. the outbreak of
a new virus.
Specify the appropriate information using the items described in the following.
Then click on Apply Changes to make your settings effective.
Use the following items to configure mapping rules for Web communication:
• Use emergency policy ... overwriting all methods
Select an emergency policy from the drop-down list provided here. This
policy will be applied whenever an emergency situation occurs, e. g. the
outbreak of a new virus.
It will overrule all policies that would otherwise be applied according to the
rules and methods configured here.
• Mapping method order for REQMOD
Use the items provided in this area to configure a mapping method, which
will include specifications on what is mapped (map from: IP address, user
or group name), using what authentication method (map via: lookup on an
LDAP or NTLM server, or a Novell eDirectory server), and what rule.
The rule will in turn specify the policy that is applied to the mapped object.
You can configure more than rule for a method.
You can also configure more than one method. Methods will then be applied
in the order you position them here. Up to five methods can be configured
this way.
The specifications made in this are valid for REQMOD communication.
They can be applied also to RESPMOD communication, otherwise methods
and rules for RESPMOD communication can be configured separately
in an area below this one.
The following items are provided to configure mapping methods for REQ-
MOD communication:
— Map from
From this drop-down list, select what you want to map: IP, User, or
Group.
— Map via
From this drop-down list, select whether you want to map directly, e. g.
a user name or an IP address to a policy, or if you want there to be a
lookup first, e. g. a lookup on an LDAP or NTML server, or on a Novell
eDirectory server.

— Using these rules
User Management
The drop-down list provided here displays the name of the rule or rules
belonging to this mapping method. The name is a combination of the
information specified in the Map from and Map via fields, e. g. User-
LDAP-1.
In order to specify more information for a rule, click on the Apply
Changes button first to make the settings specified so far effective.
Then click on the Edit rules and options button next to the rules
entry in question. This will take you to another tab where you can
specify the appropriate information.
To add another rule under the same name, e. g. User-LDAP-2, and
specify information for it, select Create new rules from the list and
click on the Edit rules and options button.
— Use REQMOD mapping also for RESPMOD
Make sure this option is enabled if you want the same methods and
rules to be applied in RESPMOD and in REQMOD communication. The
option is enabled by default.
— Determine RESPMOD policy during REQMOD
Enable this option to make use of authentication information that is
missing in RESPMOD, but availableinREQMOD,alsoforRESPMOD.
The setting of this option does not depend on what has been configured
for the Use REQMOD mapping also for RESPMOD option above.
When, e. g. a mapping method is configured based on the user name,
the corresponding information may be retrieved from the Proxy Authorization
header (Standard Request header). If the SSL Scanner is to be
used at the same time, the Proxy Authorization header will be included
only in the first REQMOD message, i. e. in the CONNECT request,
and not in any of the further requests, which are encrypted.
In this case, you can enable the option described here to retrieve the
missing information also for the RESPMOD messages.
• Mapping method order for RESPMOD
Use the items provided here to configure mapping methods and rules for
RESPMOD communication. The items are only made available if you have
disabled the UseREQMODmappingalsoforRESPMODoption.
Use the items in the same way as described above for REQMOD communication
mapping.
2–23

User Management
2–24
Mapping Options
The Mapping Options section looks like this:
Using this section, you can configure what should happen if the mapping
process fails for a user request.
After modifying this setting, click on Apply Changes to make the modification
effective.
Use the following radio buttons to configure the action in case of a mapping
failure:
• Block request
If you want to block the request, make sure this radio button is checked.
The radio button is checked by default.
• Allow request and use default policy
Check this radio button to allow the request and use the default policy for
further processing.
Mapping Cache
The Mapping Cache section looks like this:
Using this section, you can configure a time interval for keeping data on
mapped users in the cache. The data can be kept there even if the corresponding
requests failed.
The mapping cache stores user names and IP addresses as input data and a
policy names as the corresponding output data.
This stored information can be re-used, rather than each time repeating external
server requests for input data. Looking up cached information is faster,
which enhances system performance.

User Management
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure the mapping cache:
2.3.4
E-Mail Mapping
• Time to keep users in cache: ... minutes
In the input field provided here, enter the time interval (in minutes) for keeping
user data in the mapping cache. The default time is 30 minutes.
• Cache failed requests
Mark this checkbox to cache also data retrieved from requests that were
not allowed.
The E-Mail Mapping tab looks like this:
There are two sections on this tab:
• Mapping Process
• Mapping Options
They are described in the following.
2–25

User Management
2–26
Mapping Process
The Mapping Process section looks like this:
Using this section, you can configure mapping rules to assign policies to e-mail
messages according to the information provided in these messages. To retrieve
this information, an internal scheme or an LDAP lookup can be applied.
Specify the appropriate information using the items described in the following.
Then click on Apply Changes to make your settings effective.
Use the items provided under this heading to configure mapping rules for e-mail
communication:
• Mapping method order for filtering e-mails (RESPMOD)
The following items are provided here:
Use the items provided in this area to configure a mapping method, which
will include specifications on what is mapped (map from: IP address, user
or group name), using what authentication method (map via: LDAP or
NTLM lookup), and what rule. The rule will in turn specify the policy that
is applied to the mapped object. You can configure more than rule for a
method.
You can also configure more than one method. Methods will then be applied
in the order you position them here. Up to five methods can be configured
this way.
The specifications made in this are valid for REQMOD communication.
They can be applied also to RESPMOD communication, otherwise methods
and rules for RESPMOD communication can be configured separately
in an area below this one.
The following items are provided to configure mapping methods for e-mail
messages RESPMOD communication:
— Mapping scheme
From this drop-down list, select the scheme you want to be used for
the mapping method: Internal or LDAP.

2.4
User Management
You can configure more than one method. Methods will then be applied
in the order you position them here. Up to two methods can be
configured this way.
In order to specify more information for a mapping scheme, click on
the Apply Changes button first to make the settings specified so far
effective. Then click on the Edit rules and options button next to the
scheme entry in question.
This will take you to another tab where you can specify the appropriate
information.
Mapping Options
The Mapping Options section looks like this:
It allows you configure the use of all the methods that were selected in the
Mapping Process section above for policy mapping purposes.
Usethefollowingitemtodothis:
• Use all selected methods to assign policies
User Database
Enable this option to have all methods selected above applied. Then click
on Apply Changes to make this setting effective.
The Languages options are invoked by clicking on the corresponding button
under User Management:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• User Database, see 2.4.1
• Import, see 2.4.2
2–27

User Management
2.4.1
User Database
2–28
• LDAP Synchronization, see 2.4.3
• Backup & Restore, see 2.4.4
The User Database tab looks like this:
There are two sections on this tab:
• LDAP Synchronization
• User Database
They are described in the following.
LDAP Synchronization
The LDAP Synchronization section looks like this:
Using this section, you can configure synchronization of the user data base
provided by Webwasher with an LDAP server.

User Management
If users have been able to authenticate themselves on the LDAP server, their
credentials are added to the user database.
After specifying this setting in an appropriate way, click on Apply Changes to
make it effective.
Use the checkbox labeled as follows to configure LDAP synchronization:
• Allow new Users to add themself to the User Database if they can
authenticate at the LDAP Server
Mark this checkbox to enable LDAP synchronization in the way described
here.
User Database
The User Database section looks like this:
It allows you to add users to the Webwasher User Database and edit user
entries in that database.
It allows you to enter user data in the Webwasher user database.
To enter this data, use the items provided in the following area:
• Add new user
Specify the following information about the new user:
2–29

User Management
2–30
— Login Name
Login name of the new user
— Real Name
Real name of the new user
Input in this field is optional.
— Group(s)
User group or groups you want to assign the new user to
Input in this field is optional.
— E-Mail address
E-mail address of the new user
Input in this field is optional.
— Language
Language to be used for messages to the new user
Select the language from the drop-down list provided here. Input in this
field is optional.
— Password
Password the new user is to submit for authentication.
— Password (retype)
Retype the password in this input field.
— Password must be changed at next login
Mark this checkbox to enforce a password change at the next login by
the new user.
• Add new user
After specifying the appropriate information in the area above, click on this
button to add the new user to the list.
The user list is displayed at the bottom of the section.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.

2.4.2
Import
User Management
To edit an entry, type the appropriate text in the corresponding input field of the
Real Name, Group(s) or EMail column, or select a different language from
the corresponding drop-down list.
To edit the password for a user entry, click on the corresponding Edit button.
This will open a separate window, where you can edit the password.
Note that the login name of a user entry cannot be edited.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field of the Login Name, Real Name,
Group(s) or Email column or any combination of these and enter this
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all user entries, mark the Select all checkbox and click on this
button.
The Import tab looks like this:
2–31

User Management
2–32
There is one section on this tab:
• Import User Database
It is described in the following.
Import User Database
The Import User Database section looks like this:
It allows you to import a file providing information about users into the user
database. Furthermore, you can configure a number of settings relating to this
file.
Use the following items to configure this file and import it into the user database:
• Import from
Specify the file containing the user information here. To do this, click on
the Browse button next to the input field and browsetothisfile.
Within this file, each line must contain information about one user only.
A line must consist of six entries separated by the column separator, with
each entry providing information as follows:
1. Login Name
The unique login name of the user

2. Full Name
Full name of the user
3. Groups
The groups that the user is a member of.
User Management
If the user is a member of more than one group, separate group name
by commas.
4. E-mail address
The e-mail address of the user
5. Preferred language
The language to be used for error template texts.
If you want this information to be processed, you need to configure a
corresponding language selection method.
This is done in the Language Selection section on the Languages
tab under User Management > Languages. The method you need
to select there is User Database.
6. Password
Password for the user.
This entry depends on the values you configure using the four radio
buttons under Password options in this section, see below for their
description.
• Column separator character
In the input field provided here, enter a character to be used for separating
entries in the user import file, i. e. the file that is imported into the user
database.
The default separator is the | (pipe sign).
• Password options
Specify the options for the user password here.
The first four options, which are configured using radio buttons, will determine
the password entry in the user import file, i. e. the file that is imported
into the user database.
2–33

User Management
2–34
The meaning of these options is as follows:
— Set random password and mail it to given email address
This will create a random password with a length of eight characters.
The password is sent to the address specified in the user import file.
— Password column contains clear text password name
If this option is enabled, the password will be taken from the plain text
entered in the user import file.
— Set password
The groups that the user is a member of.
If the user is a member of more than one group, separate group name
by commas.
— Password column contains NTLM hash (16 Bytes)
This will put a 16 Byte NTLM hash in place of each password specified
in the user import file. This hash is calculated as MD4 checksum based
on the unicode values of the password in question.
It is written into the user database, which will then also contain entries
for existing passwords that were encrypted.
— Password must be changed at next login
Enable this option to enforce a password change at the next login of a
user.
For this option to work, you need to specify an end user port in the End
User Port Settings section on the Ports tab under Configuration >
Web Interfaces.
• Overwrite existing entries
Enable this option to allow the overwriting of existing user entries in the
user database.
Otherwise, the attempt to overwrite existing entries will result in an error.
• Mail password to user
Enable this option to have the password sent to the corresponding user by
e-mail.
The option is always enabled and cannot be disabled if the first of the Password
options is also enabled, i. e. Set random password and mail it
to given email address.

User Management
Vice versa, it is always disabled and cannot be enabled if Password columncontainsNTLMhash(16Bytes)is
enabled.
• Import User
Click on this button to import the specified user import file with the settings
configured here.
2.4.3
LDAP Synchronization
The LDAP Synchronization tab looks like this:
There are three sections on this tab:
• LDAP Connection Details
• Attribute Details
• LDAP Authentication
They are described in the following.
2–35

User Management
2–36
LDAP Connection Details
The LDAP Connection Details section looks like this:
Using this section, you can configure some basic settings of the LDAP connection
for the user database.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following input fields to configure this connection:
• LDAP server(s)
Enter the IP address of the LDAP server here.
You can add the port number after a colon, e. g. 192.168.0.5:389.
You can specify more than one server. In this case, separate the IP addresses
by spaces.
Webwasher will then try to do load balancing based on a round-robin algorithm
(server configurations must be the same).
• WW’s user name
Enter the name here that is used by Webwasher itself to get authenticated
when logging in to the LDAP server.
• WW’s password
Enter the password used by Webwasher here.

Attribute Details
The Attribute Details section looks like this:
User Management
Using this section, you can specify where the data needed for authentication
should be extracted from.
To do this, use the items provided in the following area:
• Select where attributes originate
Authentication information can be extracted from user attributes or from
the attributes of the group a user belongs.
Select User or Group object to have information extracted from the corresponding
attributes and specify the appropriate information using following
input fields and buttons:
— User
Mark the checkbox provided here if you want to extract information from
user attributes and specify the following information:
Attributes to extract
Specify the attribute or attributes that should be extracted here ,
separating attributes by commas.
The default attribute to be extracted is cn.
2–37

User Management
2–38
Concatenation string
If more than one attribute is specified here, they will be concatenated
using the string specified here.
So, e. g. when attributes a and b are extracted and / (slash) is
specified as concatenation string, then if Webwasher gets the values
a1, a2, a3 for attribute a and b1 for attribute b, the output list
will be as follows:
a1/b1
a2/b1
a3/b1
• Group object
Mark the checkbox provided here if you want to extract information from
group attributes and specify the following information:
— Attributes to extract
Specify the attribute or attributes that should be extracted here , separating
attributes by commas.
The default attribute to be extracted is cn.
— Concatenation string
If more than one attribute is specified here, they will be concatenated
using the string specified here.
So, e. g. when attributes a and b are extracted and / (slash) is specified
as concatenation string, then if Webwasher gets the values a1, a2, a3
for attribute a and b1 for attribute b, the output list will be as follows:
a1/b1
a2/b1
a3/b1
— Base DN to group objects
Enter the Base DN (distinguishing name) for the group objects here.
This is the name of the path leading to the location where the search
for a group name should begin.
— Group member attribute name
Make sure this radio button is checked if you want enable use of the
group member attribute name and enter a name in the input field next
in the same line.
The radio button is checked by default.

User Management
The group member attribute name is the unique key of an entry for a
group name stored on the authentication server.
Note that the value specified for this name must be equal to the one
specified under Base DN to group objects.
The default name is uniquemember.
— Object class for groups
Specify an object class for groups here.
This will limit the search for group attributes to those objects that are
instances of this class.
The default class name is groupofuniquenames.
— Filter
Check this radio button if you want use a filter and enter a filtering term
in the input field in the same line.
This will limit the search for group attributes to objects with names
matching the filter.
• Real Name
Enter the real name of the user here that will be authenticated using the
attributes specified above.
• E–Mail Address
Enter the e-mail address of the user here that will be authenticated using
the attributes specified above.
• Language
Enter the language here that should be used for message to the use that
will be authenticated using the attributes specified above.
You can also specify a default language that will be used if no user is configured.
To do this, use the drop-down list labeled as follows:
— or . . . (if no mapping given or not specified for User)
Select the default language for messages to the user here.
2–39

User Management
2–40
LDAP Authentication
The LDAP Authentication section looks like this:
Using this section, you can configure It allows you to enter user data in the
Webwasher user database.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following input fields to configure these settings:
• Base DN to user object
Enter the Base DN (distinguishing name) for the user here.
This is the name of the path leading to the location where the search for a
user name should begin.
• UID attribute name
Make sure this radio button is checked if you want enable use of the group
member attribute name and enter a name in the input field next in the same
line.
The radio button is checked by default.
The UID attribute name is the unique key of an entry for a user name stored
on the authentication server.
• Filter
Check this radio button if you want to use a filter and enter a filtering term
in the input field in the same line.
This will limit the search for user attributes to objects with names matching
the filter.

2.4.4
Backup & Restore
The Backup & Restore tab looks like this:
There is one section on this tab:
• Backup & Restore
It is described in the following.
Backup & Restore
The Backup & Restore section looks like this:
It allows you to download a user database file and to restore it.
Use the following items to do this:
• Download User Database File
Click on this button to download the current user database file.
User Management
2–41

User Management
2.5
• Restore configuration from file
To restore a configuration with a particular user database file enter the file
name in this input field or browse to it using the Browse button next to the
this field.
Then click on Restore to restore the configuration.
Authentication Server
2–42
The Authentication Server options are invoked by clicking on the corresponding
button under User Management:
The options are arranged under the following tab:
They are described in the upcoming section:
• Authentication Server, see2.5.1

2.5.1
Authentication Server
The Authentication Server tablookslikethis:
At the top of this tab, there is a button labeled:
• Define Authentication Options
User Management
Click on this button to configure some general options relating to authentication.
This will open a window where you can specify the appropriate
information.
The options of this window are described in 5.2.3.
Furthermore, there are five sections on this tab:
• Authentication Server Settings
• Authentication Process
• NTLM and NTLM-Agent Authentication Options
• User Database Authentication Options
• Propagate Authentication Options
They are described in the following.
2–43

User Management
2–44
Authentication Server Settings
The Authentication Server Settings section looks like this:
Using this section, you can enable the authentication server and configure a
port on this server, as well as some additional settings for it. More settings can
be configured in the remaining sections of the Authentication Server tab.
The authentication server is used for performing the transparent authentication
of users. Configuring this kind of authentication involves several sections and
tabs of the Web interface. A description of this is given in the Transparent
Authentication subsection below.
If you want to use the authentication server, make sure the checkbox next to
the section heading is marked.
After modifying this setting or any other setting in this section, click on Apply
Changes to make these settings effective.
Use the following items to configure the authentication server:
• Port
In this input field, specify the port used on the authentication server. The
input format is:
[IP]: port
The default port number is 9094.
• Use SSL
Make sure this checkbox is marked if you want use of SSL enycryption for
communication with the authentication server. The checkbox is marked by
default.
This will protect your password against being intercepted during the authentication
process. Your password is also protected, even without SSL
encryption, if you configure use of the Webwasher user database with integrated
authentication.

User Management
ThiscanbedoneintheAuthentication Process and User Database
Authentication Options sections on this tab.
Configuring NTLM or the NTLM Agent in the Authentication Process
section and integrated authentication in the section labeled NTLM and
NTLM-Agent Authentication Options will protect your password in the
same way.
• Append parameter to avoid redirection loops
Make sure this checkbox is marked if you want to append the parameter.
The checkbox is marked by default.
Make sure this checkbox is marked if you want use of SSL enycryption for
communication with the authentication server. The checkbox is marked by
default.
This will help avoid redirection loops in situation like the following: The
browser requests URL A. The ICAP server sends a redirect to B and the
authentication server sends another redirect to A. Firefox treats this as an
endless loop and stops the request, while the Internet Explorer does not
recognise it.
Webwasher appends a dummy parameter to A by default, which will end
the loop: A->B->A2. The parameter is removed, however, in REQMOD
communication.
• Authentication expires after ... seconds
In the input field provided here, enter the time interval (in seconds) that an
authentication is to last. The default interval is 120 seconds.
After the interval configured here has expired, the ICAP server will send
another redirect for the next request, in order to renew the mapping and
authentication interval.
The disadvantage of configuring a longer interval here is that user switches
on one system or a new assignment of the IP address to another system
using DHCP will not be recognized, which makes the mapping less accurate.
On the other hand, smaller intervals lead to frequent redirects.
2–45

User Management
2–46
Transparent Authentication
The following subsection provides you with some general information on the
method of transparent authentication and describes a configuration procedure
to set up this method on Webwasher.
At the end some notes are given providing additional information.
General Information
The transparent authentication method can be configured as one of several
methods to retrieve user credentials and authenticate users based on these
credentials. It is usually incorporated in the process of mapping users to particular
policies.
Transparent authentication relies on a mapping between IP addresses and
users, whereas other methods map users and connections or requests. With
this address-based method, however, it is not possible to distinguish between
multiple users on a single system. The user names can be searched for in the
Webwasher user database, which has been provided for this purpose, or on
an LDAP or NTLM server.
Configuring transparent authentication may be appropriate in a situation where
thereisnoproxy in your configuration, but you still want to have authentication
or policy mapping, or where there is a proxy, but it is not capable of performing
the demanded authentication method.
Configuration Procedure
Configuring transparent authentication involves two kinds of steps:
• Steps that are required to configure the authentication server –
These include configuring the settings of the Authentication Server Settings
section, i. e. the section that this online help page is relating to.
• Steps that are required to configure a policy mapping rule – These
steps are required because transparent authentication is usually configured
within the process of policy mapping. They need to be performed
even if the intention is to configure only authentication and no policy mapping.
Both kinds of steps are described in the following.

User Management
Configuring the authentication server – This part of the procedure begins
withgoingtotheAuthentication Server tab under User Management >
Authentication Server, i. e. to the tab you have currently selected, and
configuring the settings of the Authentication Server Settings section.
It is continued by configuring the settings of the remaining sections on this tab.
To get more detailed information about a setting, click on the question mark in
the corresponding section.
To configure the authentication server proceed as follows:
1. Use the Authentication Server Settings section to enable the authentication
server and to configure a port on it, as well as some additional
parameters:
• Make sure the checkbox next to the section heading is marked. This
is required to have the authentication server enabled.
• In the Port input field, specify the port used on the authentication
server.
• Make sure the Use SSL checkbox is marked.
Clear it if you want to do without SSL encryption.
• In the input field labeled Transparent authentication expires after
... seconds, enter an interval (in seconds).
2. In the Authentication Process section, select an authentication method
from the first drop-down list provided here.
You may also select one of the other methods in second position. A further
option is to mark the checkbox labeled Use login page to get credentials,
and then. This will enable the use of a login page.
3. In the Authentication Process section, select an authentication method
from the first drop-down list provided here.
According to the method you selected under Authentication Process,
configure the corresponding options in the NTML and NTML-Agent Authentication
Options or the User Database Authentication Options
section.
2–47

User Management
2–48
Configuring a policy mapping rule – This part of the procedure will configure
the settings required for a policy mapping rule that includes the use of the
transparent authentication method.
To get more detailed information about a setting, click on the question mark in
the corresponding section.
To configure a policy mapping rule including transparent authentication, proceed
as follows:
1. Go to the Web Mapping tab under User Management > Policy Mapping.
2. Use the Mapping Process section to configure a rule for Web mapping.
Select User Name and map directly if you want to configure a policy
intended for a single user, or Group Name and map directly for a policy
based on the membership of a user in a particular group.
3. Click on the Edit rules and options button. This will take you to the
User based Mapping tab.
4. In the User Name Location section, select Transparent Authentication
from the drop-down list labeled Extract user information from.
5. From the drop-down list labeled Accepted Authenticated methods,
select a method, e. g. Local, orAny to allow all methods.
6. In the Add Rule section, add a rule for policy mapping.
Notes
A rule that might be added here is default = *, which will allow all authenticated
users.
To specify this rule, select default from the drop-down list of policies provided
here and enter an * in the input field next to it. Then click on the
Add first button to add this rule to the list.
The following should be kept in mind when configuring transparent authentication:
• POST requests will fail when the ICAP server sends a redirect to the authentication
server, which is only done, however for the renewal of a mapping.
This is because for the browser the request was successful and the POST
body will not be sent again after the final redirect.
• When authentication is done on a server, which is the authentication server
in this case, over a proxy connection, the Internet Explorer will not send the
credentials.

User Management
The following might be configured as a workaround here:
— Use a login page for authentication.
— Configure the Internet Explorer not to use a proxy for the authentication
server. This means that if Webwasher has been set up as a cluster, all
IP addresses must be excluded.
Authentication Process
The Authentication Process section looks like this:
Using this section, you can configure where users are authenticated. You can
also configure the use of a login page for retrieving user credentials.
The login page is a template, which is stored in the conf\errors folder of the
Webwasher program files. You can create different language versions of this
template.
Note that to configure a method for selecting the appropriate language template
you can only select methods that are available before the authentication
process. These methods are IP and Browser. They are configured in the
Language Selection section of the Languages tab under User Management
> Languages.
The authentication process may involve an LDAP or NTLM server, a Radius
server, or the User Database provided by Webwasher.
Furthermore, there is also an option for configuring the use of a Novell eDirectory
server, which will then take the role of an LDAP server, in order to
authenticate users.
On this server, information is stored about the IP addresses of authenticated
users, which can be extracted and used by Webwasher for the authentication
process.
The name of the field where the IP address of a user is stored is
NetworkAddress. The port number can be stored there with the address.
The field is in binary format, which means that no wildcard queries can be performed
for user addresses. Instead, Webwasher periodically polls the eDirectory
to retrieve the addresses of the users that logged in since the last request.
2–49

User Management
2–50
The structure of this search is reflected in a filtering term, which is configured
together with the settings for the LDAP method, see further below.
Make sure the NetworkAddress field is visible when the user information is
looked at via the LDAP server interface. Otherwise, Webwasher will not be
able to extract the information.
You can configure one or two methods of user authentication. They are applied
in the order you specify them. A user is successfully authenticated as soon as
one of the configured methods produces a match.
After selecting a method, you can specify further settings that are relevant to
this method in other sections of this tab, and in the window that appears after
clicking on the Define Authentication Options buttoninthetopareaofthis
tab.
For the NTLM and NTLM-Agent methods, this can be done in the NTLM and
NTLM-Agent Authentication Options section, and for the User Database
method in the Userdatabase Authentication Options section. Both these
sections are on this tab.
For the LDAP method, there is the LDAP Authentication section in the Define
Authentication Options window, where you also find the Radius Authentication
section for the Radius server method.
If you select eDirectory as method, you can also configure the use of a filter
for searching the user information that is needed in the authentication process.
This is done in the Novell eDirectory IP Filter input field, which is provided
in the LDAP Authentication section of the Define Authentication Options
window.
A filtering term has been entered in this field, which should not be altered since
this will prevent Webwasher from extracting the appropriate user information.
The name of the storage field on the eDirectory server has also been preconfigured
as one of the additional settings of the LDAP method and should likewise
not be altered.
Furthermore, you can configure the eDirectory option as part of the Web mapping
process. There will be a lookup of these addresses then on the eDirectory
server before they are mapped to security policies configured within Webwasher.
Use the Mapping Process section on the Web Mapping tab under User
Management > Policy Mapping to configure these settings.
After specifying the appropriate settings here, click on Apply Changes to
make them effective.

User Management
Use the following checkbox and drop-down lists to configure methods for user
authentication:
• Use login page to get credentials, and then
Mark this checkbox to have a login page presented to a user for entering
the user credentials. After this has been completed, the authentication
process will begin, using the methods configured below.
The login page will be presented when the user tries to get authenticated
for the first time and whenever the authentication interval has expired.
If no login page is used, user credentials need to be submitted only when
authentication is requested by a user for the first time, or, with integrated
authentication on Windows, not at all. These methods are not less secure
than using a login page, but clearly more comfortable.
• Authentication process methods list 1
Select a method for user authentication from this drop-down list. If you
select an additional method from the second list, they are applied according
to their order. If the first method fails, a user may still be authenticated by
the second.
The following methods are available: NTLM, NTLM Agent, LDAP, eDirectory,
User Database and Radius.
• Authentication process methods list 2
Select a method for user authentication in the same way as described
above from this drop-down list. You may also select None here, and have
just one method for authenticating users.
NTLM and NTLM-Agent Authentication Options
The NTLM and NTLM-Agent Authentication Options section looks like
this:
2–51

User Management
2–52
Using this section, you can configure options for an authentication method that
performs an NTLM lookup in order to authenticate users.
NTLM is an authentication method used by Microsoft browsers, proxies and
servers. It is more secure than other methods because the user password is
not transmitted as plain text.
The user of the NT domain is a member of several domain groups. The ICAP
server can use these groups to do the policy mapping. A list of groups must
be provided by the ICAP client.
Only Internet Explorer supports NTLM for this kind of configuration, but there
are additional utilities available for other browsers, such as Mod_NTLM for
Apache, or MSNT for Squid.
If you want to do NTLM authentication on an operating system other than Windows,
you can use an agent application, called the NTLM Agent, to enable
this. The settings configured here will apply also for the agent application.
There is a basic and an integrated method of authenticating users.
With basic authentication, the browser sends the user name and password
as plain text (less secure) to Webwasher, who plays the role of the client to
exchange authentication messages with the authentication server, so Webwasher
uses the NTLM method to authenticate the user.
Integrated authentication encrypts messages going from the client browser to
the authentication server and back. In this situation, Webwasher acts as the
proxy server and forwards authentication server messages to the client.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following items to configure this kind of authentication:
• Enable integrated authentication
Enable this option to use the integrated authentication method.
• Enable basic authentication
Enable this option to use the basic authentication method and enter the
default domain used for basic authentication in the input field provided here.
This is the default option.
• Select what groups to get from Domain Controller
From the drop-down list provided here, select what groups should be
fetched from the domain controller: Global, Local or both.

User Database Authentication Options
User Management
The User Database Authentication Options section looks like this:
This section allows you to configure the method used for authentication with
the Webwasher user database. This method can be either integrated or basic
authentication.
Integrated authentication is a challenge and response method that does not
allow to recover the password during the authentication process over a sniffed
connection. The password hash will be calculated with two random values,
one chosen by the client and one by the server.
With basic authentication, the client puts together user name and password
and sends them as a base64 encoded request header to the corresponding
destination, i. e. the proxy, the server, etc.
After modifying the settings in this section, click on Apply Changes to make
the modification effective.Using this section, you can configure authentication
by means of using the information stored in a user database.
There is a basic and an integrated method of authenticating users.
With basic authentication, the browser sends the user name and password
as plain text (less secure) to Webwasher (who plays the role of the client to
exchange authentication messages with the authentication server), so Webwasher
uses the information stored in the user database to authenticate the
user.
Integrated authentication encrypts messages going from the client browser to
the authentication server and back. In this situation, Webwasher acts as the
proxy server and forwards authentication server messages to the client.
After specifying the appropriate information, click on Apply Changes to make
this setting effective.
Use the following checkboxes to configure an authentication method for the
Webwasher user database:
• Enable integrated authentication
Mark this checkbox if you want to use integrated authentication.
2–53

User Management
2–54
• Enable basic authentication
Make sure this checkbox is marked if you want to use basic authentication.
The checkbox is marked by default.
Propagate Authentication Options
The Propagate Authentication Options section looks like this:
Using this section, you can configure the propagation of information on authenticated
users in a cluster. The submaster will propagate this information to the
master.
This way, a user that has been authenticated successfully on a site instance
needs not renew thes authentication if redirected for any reason to another site
instance.
If the cluster is running in a big network and is configured in a way that there
are lots of sub-masters with each of them being responsible for a sub-net, this
may cause problems because IP addresses that are unique locally may not be
unique in the whole cluster.
For this reason, there is the option to stop propagating authenticated users at
sub-master level. If this feature is enabled, a sub-master will only propagate
information on authenticated users to the site instances that are subscribed to
it and will not them to its master. It will also does not retrieve such information
from the master.
After modifying the setting configured here, click on Apply Changes to make
the modification effective.
Use the following checkbox to configure the propagation of user information:
• Sub master propagates authenticated users up to master
If this checkbox is marked, information on authenticated users will be propagated
from the sub-master instance in a cluster to its master.
The checkbox is marked by default.

2.6
Windows Domain Membership
User Management
The Windows Domain Membership options are invoked by clicking on the
corresponding button under User Management:
Note that these options are only available for instances of Webwasher running
on UNIX systems, such as Linux or Solaris.
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Windows Domain Membership, see2.6.1
• NTLM Authentication Test, see2.6.2
2.6.1
Windows Domain Membership
The Windows Domain Membership tab looks like this:
2–55

User Management
2–56
There is one section on this tab:
• NTLM Authentication
It is described in the following.
NTLM Authentication
The NTLM Authentication section looks like this:
Using this section, you can configure an account within one or more Windows
domains for an instance of Webwasher that is running on a particular system.
An account like this is also known under the name of "machine account" or
“computers”. It is used to forward user authentication requests received by
Webwasher to the domain controller.
The domain controller checks the user credentials to verify whether a particular
user is an authenticated user within the domain, using the information stored
in its database, and sends the result back to Webwasher.
Depending on the result, a user who submitted an authentication request is
allowed or denied access to the system Webwasher is running on.
Note that you need to configure an individual account for every instance of
Webwasher that is running on a particular system.

User Management
This is also required if the Webwasher instance is a member of a cluster in a
central management or a high-availability environment since the settings described
here are not distributed within the cluster.
Furthermore, note again that this section and tab are only available for instances
of Webwasher running on UNIX systems, such as Linux or Solaris.
Use the following items to configure a Webwasher account in a Windows domain:
• Windows domain name
In this input field, type the name of the Windows domain that the Webwasher
account should be joined to.
Note that you need to type the name without extension, e. g. securecomputing,
instead of securecomputing.com.
• Webwasher account name
In this input field, type the Webwasher account name, which is the “machine”
name or “computer” name of the system Webwasher is running on.
Note that this name must not be longer than 15 characters.
Remember that you need to specify an individual account name for every
Webwasher instance and also need to repeat the procedure of configuring
all the settings described here for every instance, even if it is a member of
a central management or a high-availability cluster.
• Overwrite existing account
Mark this checkbox to have the account you are presently configuring overwrite
an account that existed before under the same name.
In this case, you should make sure that the existing account is actually not
needed anymore.
• Configured Domain Controller(s)
In this input field, specify one or more domain controllers. This should be
done by typing their host name or names.
IP addresses may also be used here, but this could in some cases lead
to problems with correctly assigning users to their domains. This means
that a user would have to submit a domain name together with the usual
credentials in order to be authenticated.
When specifying more than one controller here, separate entries by commas.
Note also that any host name you specify here must be resolvable.
Note, furthermore, that Webwasher will connect only to one domain controller
at a time.
2–57

User Management
2–58
If more than one controller is configured, Webwasher will try to connect to
the first in the list, and in case this one is down, go through the list retrying
until a connection has been established successfully.
• Administrator name
In this input field, type the name of an administrator account that has permission
to execute the configuration activities required for setting up Webwasher
accounts in a Window domain.
Note that the information you specify here is only used once to complete
the configuration procedure and is not stored afterwards.
• Password
In this input field, type the password for the above administrator account.
Note that also this information is only used once and not stored.
• Join domain
After specifying the appropriate information, click on this button to let a
Webwasher account join a Windows domain.
If this action was successful, a corresponding entry is added to the list of
accounts, which is displayed at the bottom of the section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To filter the list output, type a filtering term in input field at the top of the
Domain column and enter it using the Enter key of your keyboard. The
list will then only display entries with domain names matching this term.
To edit an entry, type the appropriate information in the corresponding input
field of the Domain Controller(s) column and click on Apply Changes
to make the modification effective.
You can edit more than one entry at a time and make the modification
effective in one go.
Note that you cannot edit the information in the Domain and Account
columns.

User Management
The indicator in the Status column shows the status for each entry. It can
take different colors, which have the following meanings:
— Gray
The account is joined to the domain, but so far no authentication request
has been submitted through this account, so it is unclear whether
it is currently possible to connect to the domain controller.
The gray color is also shown when a new domain was added to the
configuration, regardless of whether the red or green color was previously
shown for the account.
— Red
The account is joined to the domain, but there is a problem with the
connection to the domain controller.
— Green
The connection between account and domain controller is working without
any problems.
To remove an account from the domain it is currently joined to, use the following
button, which is provided for each entry:
• Leave domain
Click on this button to make an account leave its configured domain.
2–59

User Management
2.6.2
NTLM Authentication Test
2–60
The NTLM Authentication Test tab looks like this:
There is one section on this tab:
• NTLM Authentication
It is described in the following.

NTLM Authentication
The NTLM Authentication section looks like this:
User Management
Using this section, you can test the settings you configured for NTLM authentication
of a user in a Windows domain.
If the test is passed successfully, information is displayed on the connection
status, the authentication result for a given user, and the groups that this user
is a member of within the domain.
Use the following items to perform the authentication test:
• Domain
In this input field, enter the domain that the user should be authenticated
for
• User
In this input field, enter the user name
• Password
In this input field, enter the password for the above user name
2–61

User Management
2.7
• Authenticate user
After submitting information in the three fields above, click on this button to
perform the authentication test.
If the test was passed successfully, you will see the following information in the
area below the button:
• Connection status
Status of the connection to the domain controller
• Active DC
Languages
2–62
Name of the domain controller that a connection has been established to
• Authentication result
Information whether the authentication process was performed successfully
for the user in question
• User groups
Number of groups within the Windows domain that this user is a member
of
A list of these groups is provided below the User groups line.
The Languages options are invoked by clicking on the corresponding button
under User Management:
The options are arranged under the following tabs:
They are described in the upcoming section:
• Languages, see 2.7.1
• Import Language Pack, see 2.7.2

2.7.1
Languages
The Languages tab looks like this:
There are three sections on this tab:
• Supported Languages
• Language Selection
• Language Selection Parameters
They are described in the following.
User Management
2–63

User Management
2–64
Supported Languages
The Supported Languages section looks like this:
This section displays all languages that have been configured for sending messages
to users of Webwasher, e. g. error messages or notifications. From
these, you can select the languages that are actually used for sending messages.
Webwasher will not support languages that have not been selected
here.
This is especially useful if you are customizing messages, but do not want to
customize them in all available languages.
The languages that are available for Webwasher and displayed here must have
been entered in the global.ini (Windows) or global.conf (Linux/Solaris) configuration
file.
For a description of how to add more languages to this file, see Chapter 7,
Language Configuration, of the Webwasher Reference Guide.
Note that the following languages are displayed here by default: German,
English, French, and Japanese. These are also the languages that user
message templates are delivered for with the Webwasher software.
You can implement the use of additional languages by importing sets of user
message templates, known as "Language Packs", into Webwasher. Language
packs are available for Italian, Spanish, Portuguese, Chinese, and Korean.
Use the items on the Import Language Packs tab under User Management
> Languages to import these.
If you want Webwasher to support other languages than those mentioned so
far, you need to provide own translations of the corresponding user message
templates. For information on how to implement them within Webwasher, see
also Chapter 7 of the Reference Guide.
You can select more than one language here, which enables you to configure
different languages for different users, e. g. with regard to their IP addresses
or the security policies they have been mapped to.
In the Language Selection section, you can configure methods to establish
the language that is appropriate for sending messages to a particular user under
particular circumstances.
The Language Selection Parameters section is provided to configure settings
for these methods. A configuration example is given on the online help
page for this section.

User Management
After specifying the appropriate settings here, click on Apply Changes to
make them effective.
Use the following items to configure the supported languages:
• German [de], English [en], etc.
Mark the checkbox of the languages you want to be supported for user
messages.
The English checkbox is marked by default.
Language Selection
The Language Selection section looks like this:
Using this section, you can configure methods to establish which language is
appropriate for sending messages to a particular user.
Methods are applied in the order you configure them here. If no supported
language is found by applying the first method, Webwasher uses the second
method in the list to look up the language, and so on. If none of the selected
methods yields a supported language, the default language is used.
Note that some of these methods and corresponding parameters can be configured
with regard to Web or e-mail traffic only.
After specifying the appropriate settingss, click on Apply Changes to make
them effective.
Use the following items to configure methods for language selection:
• Default language
From this drop-down list, select the language Webwasher should use as
default. By default, English is the default language.
2–65

User Management
2–66
• 1.Method, 2.Method, etc.
From the drop-down lists provided here, select the methods you want Webwasher
to apply for determining which language should be used in a message
to a particular user.
The method you select from the first list will be applied first, and so on.
By default, only one method is selected from the first list, which is Browser,
whereas no methods are selected from the remaining lists.
The following methods can be selected here:
— Browser
Webwasher uses the browser language of a client that sent a request
for sending any messages back to this client.
— IP
The language Webwasher uses for sending messages to a client depends
on the range of IP addresses the client lies within. Languages
are assigned to particular ranges in the Language Selection Parameters
section.
Note that this is a method for Web traffic only.
— Email
The language Webwasher uses for sending messages depends on particular
attributes of the e-mails the messages are related to. These attributes
are configured in the Language Selection Parameters section.
Note that this is obviously a method for e-mail traffic only.
— Policy
The language Webwasher uses for sending messages depends on the
policies configured for the filtering measures that caused the messages
to be sent. Languages are assigned to particular policies in the Language
Selection Parameters section.
— LDAP
The language Webwasher uses for sending messages to a client depends
on the language attribute and other attributes that have been
stored on an LDAP server for this client. These attributes are configured
in the Language Selection Parameters section.
Note that this is a method for e-mail traffic only.

— User Database
User Management
The language Webwasher uses for sending messages to a particular
user depends on the language configured for this user in the Webwasher
User Database, see 2.4.1.
Language Selection Parameters
The Language Selection Parameters section looks like this:
Using this section, you can configure parameters relating to the methods of
the Language Selection section.
Note that some of these methods and corresponding parameters can be configured
with regard to Web or e-mail traffic only.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure language selection parameters:
• LDAP language attribute
In the input field provided here, enter the attribute that should be searched
for on the LDAP server when the LDAP method is used for selecting languages.
If it can be found within the entries stored for a client on this server, Webwasher
will use the corresponding language for sending messages to this
client.
2–67

User Management
2–68
Note that this method and attribute can only be configured for e-mail traffic.
Below this input field, there is a link that takes you to the Recipient LDAP
Check tab, where you can configure more settings of the LDAP server.
• Language
This column provides a list of the languages Webwasher will select from
when sending messages. To determine which language should be selected
in a given situation, you configured methods in the Language Selection
section.
Use the input fields in the columns next to this column to configure parameters
for each of these methods and with regard to each of the languages
in the list:
— IP-Range
Enter the range of client IP addresses here that Webwasher should
send messages to in a particular language. This can be done by actually
entering a range of addresses (specifying its beginning and end),
or a single address, or a list of addresses.
Note that configuring this parameter for a language is only meaningful
if you have selected IP as method in the Language Selection section
and that this method works for Web traffic only.
— Email-Match
Enter a regular expression here that must be matched by one of the
attributes of an e-mail. If there is a match, Webwasher will send messages
relating to that e-mail in a particular language.
Note that configuring this parameter for a language is only meaningful
if you have selected Email as method in the Language Selection
section and that this method obviously works for e-mail traffic only.
— LDAP-Match
Enter a regular expression here that must be matched by the attributes
entered for a client on an LDAP server. If there is a match, Webwasher
will send messages to that client in a particular language. Use of this
attribute is made in addition to the language attribute configured above.
Note that configuring this parameter for a language is only meaningful
if you have selected LDAP as method in the Language Selection
section and that this method works for e-mail traffic only.

• Policy
User Management
This column provides a list of the security policies that have been configured
so far under Webwasher.
You can configure a language for each of these policies, which will enable
Webwasher to use this language for messages relating to a filtering measure,
e. g. Block or Allow, that was triggered under the policy in question.
Use the drop-down lists in this column to do this:
— Language
Select a language for each of the policies listed here from the dropdown
list next to it.
2.7.2
Import Language Pack
The Import Language Pack tablookslikethis:
There is one section on this tab:
• Import Language Pack
It is described in the following.
2–69

User Management
2–70
Import Language Pack
The Import Language Pack section looks like this:
Using this section you can download a language pack from a Web server provided
by Secure Computing and import it into Webwasher. This will enable
Webwasher to display messages sent to the user, such as error and e-mail
digest messages, in a language other than English.
For information on how to configure the use of other languages, see the Languages
tab and the corresponding online help pages.
Note that the language information for French, German and Japanese is
shipped with Webwasher, so no import of a language pack is required for
these languages. Language packs are available for the following languages:
Spanish, Portuguese, Italian, Chinese, and Korean.
Before importing a language pack into Webwasher, you need to download it
from the Webwasher Extranet and store it in a location within your local file
system.
To access the Extranet, you need a user account and password. Within the
Extranet, go to Download > Language Packs to download packages for
languages as required.
After a language pack has been imported, the language in question is displayed
in the Supported Languages section of the Languages tab. To actually enable
support for it, mark the checkbox next to it and click on Apply Changes
(as described in the Supported Languages subsection of 2.6.1).
Use the following items to import a language pack:
• Import language pack from
Specify the file name of the language pack you want to import in this input
field.
To do this, click on the Browse button next to the field and browse to the
location where you have stored the language pack file in question.
• Import
After browsing to the appropriate language pack file, click on this button to
import it into Webwasher.

Reporting
Chapter 3
The functions described in this chapter are accessible over the Reporting tab
of the Web interface:
These functions allow you to configure the reporting features provided by Webwasher
such as, e. g. the viewing of live reports or log file management.
The upcoming sections describe how to handle these functions. The description
begins with an overview.
3–1

Reporting
3.1
Overview
3.2
The following overview shows the sections of this chapter:
System Configuration Guide – Webwasher Web Gateway Security
Introduction
User Management
Reporting Overview –thissection
Caching
Proxies
Configuration
Live Reports for
policy
View Live Reports, see 3.2
Overall Reporting Log File Management, see 3.3
View Log Files, see 3.4
Live Report Management, see 3.5
View Live Reports, see 3.6
Miscellaneous 4-Eyes Principle, see 3.7
View Live Reports (For Policy)
3–2
Deanonymization, see 3.8
The View Live Reports options are invoked by clicking on the corresponding
button under Reporting:
These are policy-dependent options, i. e. they are configured for a particular
policy. When you are configuring these options, you need to specify this policy.

Reporting
To do this, select a policy from the drop-down list labeled Live Reports for
policy, which is located above the View Live Reports button:
The options are arranged under the following tab:
They are described in the upcoming section:
• View Live Reports, see 3.2.1
To configure overall View Live Reports options, i. e. options that are not
policy-dependent, see 3.6.
3.2.1
View Live Reports
The View Live Reports tab looks like this:
There are three sections on this tab:
• Policy Statistics
• Policy Summary Reports
• Display Options
3–3

Reporting
3–4
They are described in the following.
Policy Statistics
The Policy Statistics section looks like this:
It allows you to view detailed information on the filtering activities going on
under a particular policy in your corporate network.
To view a particular kind of information, click on the corresponding icon (magnifying
glass with paper).
The following kind of information can be viewed:
• Filter Statistics
Shows the amount of data washed by the Advertising Filter, Privacy Filter,
Security Filter and the Media Type Filter.
• Category Overview
Provides an overview of the number of requests made, broken down by
category, as well as an overview of the number of external and the number
of blocked requests, regardless of whether they were blocked or not.
Policy Summary Reports
The Policy Summary Reports section looks like this:
It allows you to view summary reports on filtering activities performed under a
particular policy in your corporate network.

Reporting
Different reports can be written according to the way Webwasher is configured,
i. e. (1) as proxy for client communication, or (2) filtering Web requests and uploads
in REQMOD communication, or (3) filtering Web downloads and e-mail
messages in RESPMOD communication, or in a combination of (2) and (3).
Use the following buttons to perform other activities relating to these reports:
• Export All
Click on this button to export all reports to an Excel format.
• Reset All
Click on this button to reset all reports.
Display Options
The Display Options section looks like this:
It allows you to configure the way reports are displayed.
Specify information regarding this display in the input fields described below.
Then click on Apply Changes to make your settings effective.
The following parameters can be configured here:
• Number of displayed items
Enter the appropriate number of items here. The default number is 10.
• Automatically refresh after ... seconds
Enter the appropriate number of seconds here. The default number is 0, i.
e., no automatic refreshing.
3–5

Reporting
3.3
Log File Management
3–6
The Log File Management options are invoked by clicking on the corresponding
button under Reporting:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Activate Log Files, see 3.3.1
• Auto-Rotation, see 3.3.2
• Auto-Deletion, see 3.3.3
• Auto-Pushing, see 3.3.4
• Content Reporter, see 3.3.5
In addition to these descriptions, a procedure is also described for configuring
the processing of Webwasher log data by SmartReporter:
• Configuring Log File Processing for SmartReporter, see 3.3.6
SmartReporter is a component of SmartFilter, which is another Web Gateway
Security product provided by Secure Computing.

3.3.1
Activate Log Files
The Activate Log Files tablookslikethis:
There are two sections on this tab:
• Activate Log Files
• Custom Log Files
They are described in the following.
Reporting
3–7

Reporting
3–8
Activate Log Files
The Activate Log Files section looks like this:
Using this section, you can configure the writing of log files. You can also
determine whether they should be written on the ICAP client or the ICAP server.
Some log files can be configured for ICAP client and server, some only for the
ICAP server and some only for the ICAP client.
Enable the log files you want to have written by marking the corresponding
checkboxes. Then click on Apply Changes to make your settings effective.
To customize a log file, click on the button in the same line, which is labeled
according to the log file name, e. g. Customize Audit Log.
This will take you to another log, where you can configure values for customizing
this log.
You can also configure your own customized log files, see the Custom Log
Files section below.

Custom Log Files
The Custom Log Files section looks like this:
Reporting
Using this section, you can configure custom log files, i. e. log files of your
own, which are written by customized actions.
To create a custom log file, enter a name for it in the New Name input field and
click Create. The custom log file will then be displayed as a new entry in a list
above the input field.
To configure a custom log file, use the following input field:
• New Name
Enter a name for the new log file in this input field. Then click on theCreate
button next to it.
An entry for the new log file is then inserted in the custom log file list, which is
displayed at the top of the section.
Next to each list entry, the following button is provided:
• Define Log Structure
Click on this button to continue configuring the custom log file in question.
This will take you to another tab, where you can specify the appropriate
values.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
3–9

Reporting
Use the following items to perform other activities relating to the list:
• Filter
3.3.2
Auto-Rotation
3–10
Type a filter expression in the input field of the DLog File Name column
and enter it using the Enter key of your keyboard. The list will then display
only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
The Auto-Rotation tab looks like this:

There is one section on this tab:
• Auto-Rotation
It is described in the following.
Auto-Rotation
The Auto-Rotation section looks like this:
Reporting
Using this section, you can configure the automatic rotation of log files in order
to control log file growth.
The oldest log files are renamed, the current log is moved, and a new log file
is created.
3–11

Reporting
3–12
The frequency of rotation is configured separately for each log file.
Make sure the checkbox next to the section heading is marked if you want to
configure the options provided here.
After configuring these options, click on Apply Changes to make your settings
effective.
Use the following items to configure overall settings for log file rotation:
• Rotate daily at ...
In this input field, enter the time you want the rotation to be performed each
day.
Specify a local time value, using the 00:00 to 23:59 time format (24 hours
clock).
• Rotate Log Files now
Click on this button to rotate all log files immediately, regardless of the
configured time schedule.
Use the following items to configure settings for individual log file rotation:
• Rotate if size exceeds ... MB.
Enable this option and enter a size value (MB) in the input field provided
here to prevent the log file in question from becoming too large. The log
file will be rotated as soon as its size exceeds the configured value.
The minimum size that can be specified here is 1 MB. It can be increased
by single integer steps.
• Rotate daily
Enable this option to configure a daily rotation for the log file in question.
Rotation is performed at midnight in this case.

3.3.3
Auto-Deletion
The Auto-Deletion tab looks like this:
There is one section on this tab:
• Auto-Deletion
It is described in the following.
Reporting
3–13

Reporting
3–14
Auto-Deletion
The Auto-Deletion section looks like this:
Using this section, you can configure the automatic deletion of log files in order
to control log file growth. The frequency of deletion is configured separately
for each log file.
Make sure the checkbox next to the section heading is marked if you want to
configure the options provided here.
After configuring these options, click on Apply Changes to make your settings
effective.

Reporting
Use the following items to configure settings for individual log file deletion:
• Keep only ... old log files at a time.
Enable this option and enter the appropriate number in the input field provided
here.
The oldest log file will be deleted as soon as the number of log files in the
log directory exceeds the configured value.
If this option is enabled together with the option described below, old log
files will be deleted until the configured values are reached for both options.
• Keep only log files of the last ... days
Enable this option and enter the appropriate number in the input field provided
here.
Log files older than the date specified here will be deleted.
If this option is enabled together with the option described above, old log
files will be deleted until the configured values are reached for both options.
3–15

Reporting
3.3.4
Auto-Pushing
3–16
The Auto-Pushing tab looks like this:
If you want to configure any of the options provided on this tab, you need to
mark the following checkbox:
• Enable auto-pushing
The options are grouped in four sections:
• Common Push Target
• Separate Push Targets
• Push log files after rotation
• System Notification
They are described in the following.

Common Push Target
The Common Push Target section looks like this:
Reporting
Using this section, you can configure log file pushing as a security feature (for
backup), as well as for analyzing purposes.
Log files stored on the Webwasher server can be uploaded to another HTTP,
HTTPS or FTP server. This server is a common push target, i. e. all log files
are uploaded there.
If the upload server demands authentication, you can configure a username
and password to authenticate the file upload process.
After specifying the appropriate information, click on Apply Changes to make
your settings effective. Note that the Enable auto-pushing checkbox at the
top of this tab must also be checked for these settings to take effect.
Use the following items to configure settings for pushing log files to a common
target:
• Upload to ... every ... hours
In the first of the input fields provided here, enter the name of the upload
server. The input format is:
ftp | http | https)://server[:port][/path/]
In the second input field, enter a number to specify the hourly interval for
pushing log files to this server.
• Authentication
Specify login credentials in the following two input fields, in case the upload
server demands authentication:
— Username
User name to be submitted for authentication to the upload server
— Password
Password to be submitted for authentication to the upload server
3–17

Reporting
3–18
Separate Push Targets
The Separate Push Targets section looks like this:
Using this section, you can configure log file pushing as a security feature (for
backup), as well as for analyzing purposes.
Log files stored on the Webwasher server can be uploaded to another HTTP,
HTTPS or FTP server.

Reporting
Differing from the Common Push Target section described above, you can
configure an individual push target, i. e. upload server, for each log file here,
e. g. for the HTTP Access Log, the Security Log etc.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Note that the Enable auto-pushing checkbox at the top of this tab must also
be checked for these settings to take effect.
Use the following items to configure settings for pushing log files individually
and to separate targets:
• Upload to ... every ... hours
In the first of the input fields provided here, enter the name of the upload
server. The input format is:
ftp | http | https)://server[:port][/path/]
In the second input field, enter a number to specify the hourly interval for
pushing log files to this server.
• Push Log Files Now
Click on this button to push all log files to their upload servers immediately,
regardless of the configured time schedule.
Push log files after rotation
The Push log files after rotation section looks like this:
It allows you to configure the pushing of log files after their rotation.
By default, every log file that an upload server was configured for is pushed
after being rotated, either manually or automatically. This does however not
apply to the errors log file. This log file is only pushed according to its upload
interval.
Use the following checkbox to configure log file pushing after rotation:
• Push log files after rotation
Check or uncheck this checkbox to have log files pushed after rotation or
not.
3–19

Reporting
3–20
System Notification
The System Notification section looks like this:
It allows you configure the sending of e-mail notifications if there was a failure
in pushing log files.
Use the following items to configure these notifications:
• Send notification upon log file pushing failure
Enable this option if you want e-mail notifications to be sent in case of a
log file pushing failure.
• Recipient
In this input field, enter the e-mail address of the recipient the notifications
should be sent to.
• Edit notification mail server
Click on this button to go to a tab where you can configure a mail server
for processing your notifications.
For a description of this window, see the Notification Settings Window
subsection of 5.5.3.
• Send Test Messages
After configuring the sending of e-mail notifications as described above,
click on this button to have test messages sent.

3.3.5
Content Reporter
The Content Reporter tab looks like this:
There is one section on this tab:
• Content Reporter
It is described in the following.
Content Reporter
The Content Reporter section looks like this:
Reporting
It provides some introductory information on the Webwasher Content Reporter
product.
3–21

Reporting
For more information on this product, see the Content Reporter Installation and
Configuration Guide and the Content Reporter User’s Guide for Reporting.
3.3.6
Configuring Log File Processing for SmartReporter
3–22
In order to have log files that were created by Webwasher processed within
SmartReporter, you need to perform a number of configuration activities.
SmartReporter is set up as a component during the installation of SmartFilter,
which is another one of the Web Gateway Security products provided by Secure
Computing.
The following sections describe this setup and the configuration activities that
need to be performed both on SmartReporter and on Webwasher.
Setting up SmartReporter
Setting up SmartReporter is a part of the SmartFilter installation procedure.
When going through this procedure, you can mostly use the default settings.
Note that a Windows 2000/2003 server (English language version) is required
for running SmartFilter with the SmartReporter component.
In order to set up SmartReporter, make sure that the following configuration
activities are performed during the installation procedure:
1. When installing components, make sure the following three are selected:
• SmartFilter Administration Server
• SmartFilter Administration Console
• SmartReporter

Reporting
2. Provide a user name and password for access to the SmartFilter Administration
Console:
3. Specify mail settings for receiving notifications with regard to all SmartFilter
components:
Setting up a Log Processing Account
In order to have SmartReporter process the log files that are sent by Webwasher,
a log processing account must be set up within SmartReporter.
To do this, proceed as follows:
1. Log in to SmartReporter, using the user name and password you configured
when installing the SmartFilter components.
3–23

Reporting
3–24
2. Go to Administrator Options > System Option.and select the Log
Processing tab.
3. In order to set up a new log processing account, click on the Add button
below the second list field, which is used to display the list of existing log
processing accounts.
This will make the Add Log Processing Account window appear.
4. In the Name field of this window, type Webwasher as account name and
select Webwasher – Default Format as log format.
Then provide a user name, e. g. admin, and password for access to the
account.
The SmartFilter administration servers will then accept log files that are
sent with this logon information.

Configuring the Webwasher Access Log
Reporting
Finally, you need to configure the access log file format within Webwasher in
order to make it correspond to the Default Format you selected as part of the
SmartFilter configuration.
To do this, proceed as follows:
1. In the Webwasher Web interface, go to Reporting > Log File Management
and select the Activate Log Files tab:
On this tab, click the Customize HTTP Access Log button to make the
HTTP Access Log Customizing tab appear.
2. In the Log File Structure field of this tab, enter the log file structure that
is needed in order to enable SmartReporter to process Webwasher log
files.
This structure is as follows:
src_ip - auth_user time_stamp "req_line" status_code
bytes_to_client "referer" "user_agent" block_res
"categories"
3–25

Reporting
3–26
After entering the log file structure in the tab field, click on Apply Changes
to make this setting effective:
3. Go back to Log File Management and select the Auto-Pushing tab.
Use this tab to configure the pushing of the Webwasher log files to
SmartReporter.
In the User Name and Password fields, which are provided under Authentication
on this tab, enter the user name and password you configured
in the Add Log Processing Account window of SmartReporter.
A push can be performed using the different protocols. To have it performed
via FTP, the following must be entered in the HTTP Access Log
field under Separate Push Targets:
ftp://username:password@:9021

Reporting
After specifying these settings, click on Apply Changes to make them
effective:
4. To have a push performed immediately, click on the Push Log Files Now
button, which is provided at the bottom of the tab:
Otherwise, you can have a push performed in certain time intervals. To
configure these intervals, enter the number of hours, e. g. 3, in the every
... hours field next to the HTTP Access Log field.
After a push has been performed for the Webwasher log files, the corresponding
data for URL categories and Web sites will be displayed by the
Quick View feature within SmartReporter.
Note, however, that after modifying the log file structure, a dummy access.log
file is also created, which contains no data yet.
3–27

Reporting
3.4
View Log Files
The View Log Files options are invoked by clicking on the corresponding
button under Reporting:
The options are arranged under the following tab:
They are described in the upcoming section:
3.4.1
View Log Files
3–28
• View Log Files, see 3.4.1
The View Log Files tab looks like this:

There is one section on this tab:
• View Log Files
It is described in the following.
View Log Files
The View Log Files section looks like this:
Reporting
It provides a list of the log files that are maintained under Webwasher. Using
the icons on the right side of the list, you can view a log file, save it or delete it.
On the left side of the list, there is the following column:
• Log File
This column lists the log files names.
3–29

Reporting
3–30
These may be preceded by different icons, showing whether there has
been a log file rotation for the log in question or not:
Unrotated – There has been no log file rotation for this log yet.
You can view and save the log file listed here, but not delete it.
Rotated – There has been a log file rotation for this log. You can
view and save the log file listed here, but not delete it.
Click on the icon to display the rotated log files.
Displaying Rotated Files – After clicking on the triangle pointing
to the right, this icon is displayed, while the rotated log files
of this log are shown below.
The rotated log files may be viewed, saved and deleted.
Click on the icon to hide the rotated log files.
Use the icons in the columns at the right side of the list as follows:
• View
• Save
• Delete Rotated
Clickonthisicontoviewalogfile.
Clickonthisicontosavealogfile.
Click on this icon to delete a rotated log file.

3.5
Live Report Management
Reporting
The Live Report Management options are invoked by clicking on the corresponding
button under Reporting:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Report Activation, see 3.5.1
• Load Reports, see 3.5.2
• Anonymization, see 3.5.3
3–31

Reporting
3.5.1
Report Activation
3–32
The Report Activation tab looks like this:
There are two sections on this tab:
• SummaryReportActivation
• Summary Report Actions
They are described in the following.

Summary Report Activation
The Summary Report Activation section looks like this:
Using this section, you can configure the writing of summary reports.
Reporting
3–33

Reporting
3–34
Different reports can be written according to the way Webwasher is configured:
• (1) as proxy for client communication, or (2) filtering Web requests and
uploads in REQMOD communication, or (3) filtering Web downloads and
e-mail messages in RESPMOD communication, or in a combination of (2)
and (3).
Enable the reports you want to have written by marking the corresponding
checkboxes. Then click on Apply Changes to make your settings effective.
The activities covered by the individual reports are as follows (*** indicate
reports that are only written to the ICAP client):
• Top Attributes by Bytes Transferred***
Shows the amount of bandwidth consumed by the categories/blocked categories
(depending on the configuration).
• TopAttributesbyNumberofRequests***
Shows the number of hits to the categories/blocked categories.
• Top Blocked Categories by Number of Requests
Shows the number of hits to already-blocked categories.
• Top Categories by Bytes Transferred
Shows the amount of bandwidth consumed from accesses to blocked and
unblocked categories.
• Top Categories by Number of Requests
Shows the number of hits to the top categories.
• Top Destinations by Bytes Transferred
Shows the amount of bandwidth consumed by accesses to the top hosts.
• Top Destinations by Number of Requests
Shows the number of hits to these hosts.
• Top E-Mail Attributes by Bytes Transferred
Shows the amount of bandwidth consumed by the categories/blocked categories
of the e-mail.
• Top E-Mail Attributes by Number of Sections***
Shows the number of sections of e-mail attributes.

• Top E-Mail Policies by Bytes Transferred***
Reporting
Shows the amount of bandwidth consumed by the top e-mail policies.
• Top E-Mail Policies by Number of Messages***
Shows the number of messages sent to/from the top e-mail policies.
• Top Media Types by Bytes Transferred
Shows the amount of bandwidth consumed by accesses to the different
media types (not including their extension).
• Top Media Types by Number of Requests
Shows the number of hits on these media types.
• Top Policies by Bytes Transferred
Shows the amount of bandwidth consumed by access to blocked and unblocked
e-mail categories.
• Top Policies by Number of Requests
Shows the number of hits based on policy.
• Top Recipients by Bytes Transferred
Shows the amount of bandwidth consumed by the top recipients of e-mail
messages and/or spam.
• Top Recipients by Number of Messages***
Shows the number of messages sent to the top recipients.
• Top Sender IPs by Bytes Transferred***
Shows the amount of bandwidth consumed by the top sender IP addresses
for e-mail messages and/or spam.
• Top Sender IPs by Number of Messages***
Shows the number of messages sent by the top sender IP addresses.
• Top Senders by Bytes Transferred***
Shows the amount of bandwidth consumed by the top senders of e-mail
messages and/or spam.
• Top Senders by Number of Messages***
Shows the number of messages sent by the top senders.
3–35

Reporting
3–36
• Top Source IPs by Bytes Transferred
Shows the amount of bandwidth consumed by the top sender source IP
addresses for e-mail messages and/or spam.
• Top Source IPs by Number of Requests
Shows the number of messages sent by the top source IP addresses.
• Top Spam Recipients***
Shows the top recipients of spam.
• Top Spam Sender IPs***
Shows the top spam sender IP addresses.
• Top Spam Senders***
Shows the top spam senders.
• Top Top-Level Domains by Bytes Transferred
Shows the amount of bandwidth consumed by accesses to the top-level
domains, e.g. .de, .com, .net, .ca.
• Top Top-Level Domains by Number of Requests
Shows the number of hits made to these domains.
• Top Users by Bytes Transferred
Shows the amount of bandwidth consumed by users accessing the Internet..
• Top Users by Number of Requests
Shows the number of hits based on users.

Summary Report Actions
The Summary Report Actions section looks like this:
Using this section, you can export and reset summary reports.
The following items are provided for performing these activities:
• Export global summary reports
Reporting
Enable this option to export all global summary reports to an Excel-readable
format (CSV).
This can be useful for further processing, such as representation in a piechart
format, or for being able to view all the (up to 500) report items, rather
than the top ten shown in the Web interface.
If you would like to change the single-character delimiter (e.g. to a tab,
or comma) between cells in Excel, this must be done manually in the
global.ini/conf file. In the [LogFiles] section, there is an entry called
ExcelSeparateChar=where you can change the character as desired.
• Export summary reports for all available policies
Enable this option to export the global summary reports as well as all current
policy reports.
• Cells are separated by
In this input field, enter the delimiter you want to use between cells in Excel.
This must be a single character, e. g. a comma.
• Export
Click on this button, to export reports according to the options configured
above.
3–37

Reporting
• Reset global summary reports
Enable this option to reset all global summary reports. This will not reset
the report refresh rate.
• Reset summary reports for all policies
Enable this option to reset the global summary reports as well as all current
policy reports.
• Reset
3.5.2
Load Reports
3–38
Click on this button, to reset reports according to the options configured
above.
The Load Reports tab looks like this:
There is one section on this tab:
• Enable Load Reports
It is described in the following.

Enable Load Reports
The Enable Load Reports section looks like this:
Using this section, you can configure the Webwasher load reports.
Reporting
These reports show the load on the various connections established for Webwasher,
e. g. the connection between HTTPS clients and proxy, proxy and
server, etc.
To view the reports, go to the Webwasher Load section on the View Load
tab under View Live Reports for overall reporting, see 3.6.2.
To enable load reports for a particular connection type, use the connection type
list, which is labeled:
• Count load for connections between
Mark the checkbox next to the connection type you want to enable load
reports for, e. g. HTTP clients – HTTP proxy. You can enable load
reports for more than one connection type.
Then click on Apply Changes to make your settings effective.
3–39

Reporting
3.5.3
Anonymization
3–40
The Anonymization tab looks like this:
There is one section on this tab:
• Anonymization
It is described in the following.
Anonymization
The Anonymization section looks like this:
It allows you to anonymize the names of user names in top ten live reports.
You can decrypt anonymized strings using the Deanonymization section
on the tab with the same name, see 3.8.1. To go to this tab, click on the
Deanonymization link provided above this section.

Use the following options to enable the anonymization of user names:
• Anonymize Web Reports
Reporting
Enable this option to anonymize user names in reports on Web communication.
• Anonymize Mail Reports
Enable this option to anonymize user names in reports on e-mail communication.
3.6
View Live Reports (Overall Reporting)
The View Live Reports options for overall reporting are invoked by clicking
on the corresponding button under Reporting:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• View Live Reports, see 3.6.1
• View Load, see 3.6.2
• System Statistics, see 3.6.3
3–41

Reporting
3.6.1
View Live Reports
3–42
The View Live Reports tab looks like this:
There are three sections on this tab:
• Overall Statistics
• Overall Summary Reports
• Display Options
They are described in the following.
Overall Statistics
The Overall Statistics section looks like this:
It allows you to view detailed information on the overall filtering activities going
on in your corporate network, i. e. regardless of any particular policy.

Reporting
To view a particular kind of information, click on the corresponding icon (magnifying
glass with paper).
The following kind of information can be viewed:
• Filter Statistics
Shows the amount of data washed by the Advertising Filter, Privacy Filter,
Security Filter and the Media Type Filter.
• Category Overview
Provides an overview of the number of requests made, broken down by
category, as well as an overview of the number of external and the number
of blocked requests, regardless of whether they were blocked or not.
• ICAP Server Statistics
Shows the overall per client number of REQMOD, RESPMOD, OPTIONS
and PROFILE requests and ICAP responses.
• ICAP Clients Statistics
Shows the overall per server number of REQMOD, RESPMOD, OPTIONS
and PROFILE requests and the status of the server.Shows the overall per
client number of REQMOD, RESPMOD, OPTIONS and PROFILE requests
and ICAP responses.
• SMTP Statistics
Shows the overall number of sent and received e-mail messages as well
as the amount of data transferred (in KB), maximum and average mail size
(KB) and the maximum and average amount of time (in ms) the mail is in
the system.
Overall Summary Reports
The Overall Summary Reports section looks like this:
It allows you to view summary reports on the overall filtering activities performed
in your corporate network, i. e. regardless of any particular policy.
3–43

Reporting
3–44
The reports relate to the way Webwasher is configured, i. e. as proxy for client
communication, or filtering Web requests and uploads in REQMOD communication
or Web downloads and e-mail messages in RESPMOD communication,
or in a combination of both.
Display Options
The Display Options section looks like this:
It allows you to configure the way reports are displayed.
Specify information regarding this display in the input fields described below.
Then click on Apply Changes to make your settings effective.
The following parameters can be configured:
• Number of displayed items
Enter the appropriate number of items here. The default number is 10.
• Automatically refresh after ... seconds
Enter the appropriate number of seconds here. The default number is 0, i.
.e, no automatic refreshing.

3.6.2
View Load
The View Load tab looks like this:
There is one section on this tab:
• View Load
It is described in the following.
Webwasher Load
The Webwasher Load section looks like this:
Reporting
It provides detailed information about the load at the various Webwasher
connections, such as the connection between HTTP clients and HTTP proxy,
HTTP proxy and HTTP server, and so on.
3–45

Reporting
You can view the current load or the load history. To do this, use the following
links, which are provided next to every type of connection:
• View Current
Click on this link to view the current load.
• View History
3.6.3
System Statistics
3–46
Click on this link to view the load history.
The System Statistics tab looks like this:
There is one section on this tab:
• System Statistics
It is described in the following.

System Statistics
The System Statistics section looks like this:
Reporting
It provides information on several system statistical issues, such as e. g. the
system name, the number of processors, the number of processes currently
running, etc.
3.7
4-Eyes-Principle
The 4-Eyes-Principle option is invoked by clicking on the corresponding button
under Reporting:
The option is provided under the following tab:
It is described in the upcoming section:
• 4-Eyes-Principle, see 3.7.1
3–47

Reporting
3.7.1
4-Eyes-Principle
3–48
The 4-Eyes-Principle tab looks like this:
On this tab, you can configure the use of two passwords for Webwasher settings
that are especially privacy-protected.
In order to protect privacy, some Webwasher functions can only be executed
if two passwords are known.
To make use of these kinds of functions that show information about
anonymized users or determine how user-related data will be collected for
reporting, you need to enter two passwords.
Use the following item to configure this special security feature:
• Protect privacy-protected settings by two passwords
Mark the checkbox provided here and click on Apply Changes to make
this setting effective.

3.8
Deanonymization
Reporting
The Deanonymization options are invoked by clicking on the corresponding
button under Reporting:
The options are arranged under the following tab:
They are described in the upcoming section:
• Deanonymization, see 3.8.1
3.8.1
Deanonymization
The Deanonymization tab looks like this:
There is one section on this tab:
• Deanonymization
It is described in the following.
3–49

Reporting
3–50
Deanonymization
The Deanonymization section looks like this:
Using this section, you can resolve anonymous strings found in log files or
reports.
Anonymous strings are strings of characters that do not yet have a variable
name assigned to them.
Use the following items to resolve an anonymous string:
• Anonymous string
Enter the string you would like to have resolved in the input field provided
here and click on the Deanonymize button next to it.
• Personalized string
Depending on the input, this output field shows the real source IP, the real
user name, or the real source host.

Caching
Chapter 4
The features that are described in this chapter are accessible over the Caching
tab of the Web interface:
These features allow you to configure the caching of Web objects that are requested
by users of Webwasher, in order to enable a general reduction of the
time that elapses until users are actually able to access the objects.
Note that these features are only available with appliance versions of Webwasher.
The upcoming sections describe how to handle these features. The description
begins with an overview.
4–1

Caching
4.1
Overview
4.2
The following overview shows the sections that are in this chapter:
System Configuration Guide – Webwasher Web Gateway Security
Introduction
User Management
Reporting
Caching
Proxies
Configuration
Quick Snapshot
4–2
Overview –thissection
Quick Snapshot, see 4.2
Policy Settings HTTP Caching, see 4.3
Policy-Independent
Settings
Cache Settings, see 4.4
Flush Cache, see 4.5
The Quick Snapshot for the caching functions is invoked by clicking on the
corresponding button under Caching:
The following tab is then provided:
It is described in the upcoming section:
• Quick Snapshot, see 4.2.1
Before this is done, however, the following subsection provides some general
information on this quick snapshot feature.

Handling the Quick Snapshot
Caching
The quick snapshot feature on this tab allows you to view summary information
about the parameters of the Webwasher cache at a glance. The information
is displayed with regard to a given time interval.
Percentages are calculated for the various categories of cache parameters.
The percentages are shown by means of a pie chart on the left side of the tab
section.
By hovering over the sections of the pie chart with the mouse cursor, you can
display the individual percentages.
On the right side of the section, parameter values are shown as they developed
in time, using either a stacked or a line mode.
The pie chart and the representation in stacked or line mode are handled in
the same way as on the Webwasher dashboard.
You can:
• Select and deselect categories for display by marking and clearing the corresponding
checkboxes:
• Select a time interval for display, using the Show last drop-down list:
• Select stacked or line mode for display by checking the corresponding radio
button:
4–3

Caching
4.2.1
Quick Snapshot
4–4
The Quick Snapshot tab looks like this:
There are four sections on this tab:
• Cache Efficiency
• Cache Bytes
• Cache Objects
• Cache Usage
They are described in the following.

Cache Efficiency
Caching
The Cache Efficiency section displays the number of times requested objects
were found within the Webwasher cache (“Hits”) and the number of times requested
objects were not found there (“Misses”) within a given time interval.
Cache Bytes
The Cache Bytes section displays the amount of bytes for requested objects
that were found within the Webwasher cache (“Bytes Hits”) and for the requested
objects that were not found there (“Bytes Misses”) within a given time
interval.
Cache Objects
The Cache Objects section displays the number of objects that are stored
in the Webwasher cache (“Cachable Objects”) and the number of objects that
were requested by users, but not stored there (“Non-Cachable Objects”) within
a given time interval.
Cache Usage
The Cache Usage section displays the percentage of cache utilization within
a given time interval.
4.3
HTTP Caching
The HTTP Caching options are invoked by clicking on the corresponding button
under Caching:
If you want to enable any of these options, make sure the checkbox on this
button is also marked. The checkbox is marked by default.
After modifying the setting of this checkbox, click on Apply Changes to make
the modification effective.
These are policy-dependent options, i. e. they are configured for a particular
policy. When you are configuring these options, you need to specify this policy.
4–5

Caching
To do this, select a policy from the drop-down list labeled Policy, which is located
above the HTTP Caching button:
Note that you can also configure HTTP caching for every individual proxy port
that is opened by Webwasher when it is running as an HTTP proxy.
For more information on this option, see the subsection on Port Settings in
5.2.1.
The HTTP caching options are arranged under the following tabs:
They are described in the upcoming sections:
4.3.1
HTTP Caching
4–6
• HTTP Caching, see 4.3.1
• Cachable Objects List, see 4.3.2
The HTTP Caching tab looks like this:

There is one section on this tab:
• Policy Dependent Settings
It is described in the following.
Policy Dependent Settings
The Policy Dependent Settings section looks like this:
Caching
Using this section, you can configure actions that should be executed upon
hits and misses of requested objects that are stored in the Webwasher cache.
The actions are configured for requests to Web objects.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items for configuring actions:
• Action on Cache Hit
From the drop-down list provided here, select an action that should be
executed when a requested Web object was found in the cache.
The following actions are available:
— Add X-Cache Header
An X-Cache header is added to the request.
— Allow
The request is allowed. This action is configured by default.
— Block
The request is blocked.
• Action on Cache Miss
From the drop-down list provided here, select an action that should be
executed when a requested Web object was not found in the cache.
For the actions that are available here, see the list under Action on Cache
Hit.
4–7

Caching
4.3.2
Cachable Objects List
4–8
The Cachable Objects List tab looks like this:
There is one section on the tab:
• Cachable Objects
It is described in the following.

Cachable Objects
The Cachable Objects section looks like this:
Caching
Using this section, you can specify the Web objects that should be stored in
the Webwasher cache.
To do this, use the area labeled:
• Add new entry
Specify an object or object type using the following items:
— From the drop-down box in the upper line of the area, select String
or International Domain Name. In the input field next to it, enter a
string to specify the object.
You may also use shell expressions to specify an object type.
Select International Domain Name here if you want to enter non-
ASCII characters and the string should be used for the domain part of
an URL
In some countries like Germany, Sweden or Japan, domain names with
non-ASCII characters are allowed.
The IDNA (International Domain Names in Applications) standard describes
how a Web browser should convert such a domain name into
pure ASCII notation used, e. g. by DNS.
Webwasher uses the pure ASCII notation as well, therefore all IDN
strings must be converted.
4–9

Caching
4–10
This is done automatically when you select International Domain
Name and enter a string with non-ASCII characters.
Note that you can not use shell expressions with IDN strings.
— From the first drop-down box in the lower line of the area, select an
option to specify the object type that the string entered above should
correspond to.
Select None if you do not want to specify an object type.
Select Web to specify the URL type for an object. Then select one of
the following options from the drop-down box next to the first box:
Any URL
Any type of URL will do for the object that should be stored.
HTTP Request URL
The URL of the object that should be stored must be the one that
is used in the HTTP request made for it.
HTTP Response URL
The URL of the object that should be stored must be the one that
is used in the HTTP response sent upon the request made for it.
— Description
In this input field you may enter a description of the object or object
type that should be stored.
Input in this field is optional.
Then use the following item to complete the configuration procedure:
— Add to Cachable Objects List
After specifying the information for the object, click on this button to
add it to the list. This addition will be valid only under the policy you are
currently configuring.
To add an object to the list for all policies, mark the checkbox labeled
Add to all policies before clicking on the button.
If an object that was configured under another policy is already on the
list, the setting of the Add to all policies checkbox will have no effect.
The configuration activities you are completing here will specify an object
or object type that should be stored on the Cachable Objects List.
Note that you can also specify which objects should not be included in this
list. This is done using the White List.

To go there, click on the Whitelist link provided here.
The Cachable Objects List is displayed at the bottom of this section.
Caching
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using
the Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the corresponding input field.
Then click on Apply Changes to make these settings effective. You can
edit more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
— Filter
Type a filtering term in this input field and enter it using the Enter key
of your keyboard. The list will then display only entries matching the
filter.
— Delete Selected
Select the entry you wish to delete by marking the Select checkbox
next to it and click on this button. You can delete more than one entry
in one go.
To delete all entries, mark the Select all checkbox and click on this
button.
— Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox
next to it and click on either of these buttons, depending on where you
want to move the entry.
The position an entry takes in the list is important since whenever a
URL is matched by more than one entry, the entry that is first in the list
wins, which means the rule in question is executed while other rules in
the list are ignored.
4–11

Caching
4.4
Cache Settings
The Cache Settings options are invoked by clicking on the corresponding
button under Caching:
The options are arranged under the following tab:
They are described in the upcoming section:
4.4.1
Cache Settings
4–12
• Cache Settings, see 4.4.1
• Cache Rules, see 4.4.2
The Cache Settings tab looks like this:

There are two sections on this tab:
• Caching
• Complete Fetch Rules
They are described in the following.
Caching
The Caching section looks like this:
Caching
Using this section, you can configure a maximum size that should not be exceeded
by objects that are stored in the Webwasher cache.
After specifying the appropriate setting, click on Apply Changes to make it
effective.
Use the following item to configure the size limit:
• Do not cache objects larger than
In the input field provided here, enter the size (in KB) that should not be
exceeded by a cached object.
Using the drop-down list next to the field, you can select the unit: Byte,
KB, MB, orGB. The default size is 5242 KB.
Complete Fetch Rules
The Complete Fetch Rules section looks like this:
Using this section, you can configure Webwasher to complete the download of
a requested object after the corresponding client connection has been closed.
If you want to use this feature, make sure the checkbox next to the section
heading is marked. The checkbox is marked by default.
4–13

Caching
4.4.2
Cache Rules
4–14
After modifying this setting or the settings for determining the conditions under
which the download should be completed, click on Apply Changes to make
the modification effective.
Use the following items to configure the size limit:
• Webwasher should complete a download even after the client has
cancelled the connection if at least ... % are completed and the
download is bigger than ... KB
In the two input fields provided here enter the percentage of completion and
a minimum size that should be reached to let Webwasher fully complete
the download of an object.
Using, the drop-down list next to the byte input field, you can select the
unit: Byte, KB, MB, or GB.
The default percentage is 85% and the default minimum size is 1024 KB.
The Cache Rules tab looks like this:
There is one section on this tab:
• Cache Revalidation Rules
It is described in the following.

Cache Revalidation Rules
The Cache Revalidation Rules section looks like this:
Caching
Using this section, you can configure rules to determine the way Web objects
are cached and delivered by Webwasher.
To do this, use the area labeled:
• Add new rule
Specify a rule using the following items:
— URL matches
In this input field enter a string to specify a URL that should be stored in
the cache. You may also use shell expressions to specify a URL type.
— Always validate cache content
If you want a URL to be validated each time it is requested by a user,
make sure this radio button is checked. The radio button is checked by
default.
— Validate content (at least) every ...
To configure the validation of a requested URL after a given time interval
has elapsed, check this radio button.
Note that Webwasher will perform a validation whenever either the interval
configured here has elapsed or the expiration date of the URL,
which is determined on the basis of data received from the corresponding
Web server, depending on which of the two events happens earlier.
4–15

Caching
4–16
If neither of the two intervals has elapsed when a URL is requested, no
validation will take place.
To configure the validation interval, select a time unit (seconds, minutes,
hours, days) from the drop-down list provided here and enter the
corresponding number in the input field.
— Override Response Header
If you want Webwasher to ignore the expiration date of a URL, mark
this checkbox. This date is determined on the basis of data received
with the response header from the corresponding Web server.
A validation will then only be performed if the URL is requested and the
interval configured under Validate content (at least) every . . .
has elapsed.
— Description
In this input field you may enter a description of the rule you are
presently configuring.
Input in this field is optional.
Then use the following item to complete the configuration procedure:
— Add to Cache Rule List
After specifying the information for a rule, click on this button to add it
to the list.
The Cachable Rule List is displayed at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using
the Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
Within the list, you can disable or enable a rule by marking the Enabled
checkbox of the corresponding entry.
After modifying this setting, click on Apply Changes to make it effective.
You can disable or enable more than one entry and make the changes
effective in one go.
To edit an entry, type the appropriate text in the corresponding URL
and Description input fields, specify the validation period using the
corresponding input field and drop-down list under Period, and mark or
clear the Override checkbox.

4.5
Flush Cache
Caching
Then click on Apply Changes to make these settings effective. You can
edit more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
— Delete Selected
Select the entry you wish to delete by marking the Select checkbox
next to it and click on this button. You can delete more than one entry
in one go.
To delete all entries, mark the Select all checkbox and click on this
button.
— Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox
next to it and click on either of these buttons, depending on where you
want to move the entry.
The position an entry takes in the list is important since whenever a
URL is matched by more than one entry, the entry that is first in the list
wins, which means the rule in question is executed while other rules in
the list are ignored.
The Flush Cache options are invoked by clicking on the corresponding button
under Caching:
The options are arranged under the following tab:
They are described in the upcoming section:
• Flush Cache, see 4.5.1
4–17

Caching
4.5.1
Flush Cache
4–18
The Flush Cache tab looks like this:
There is one section on this tab:
• Flush Cache
It is described in the following.
Flush Cache
The Flush Cache section looks like this:

Caching
Using this section, you can configure the settings for the flushing of the Webwasher
cache and perform a flush.
Use the items provided under the following heading to configure the cache
flush settings:
• Clear HTTP Cache of
The settings that you can configure here are as follows:
— URLs matching
Check this radio button to restrict the cache flush to particular URLs. In
the input field provided here enter one or more URLs.
You may also use the following shell expressions to specify a URL type:
* and ?.
— cached files bigger than
Check this radio button to restrict the cache flush to objects exceeding
a given size limit. In the input field provided here enter this size (in KB).
The default size is 1024 KB.
— cached files older than
Check this radio button to restrict the cache flush to objects older than
a given period of time. In the input field provided here enter the number
of hours to specify this time. The default time is 24 hours.
— cached files of mediatype
Check this radio button to restrict the cache flush to particular media
type. From the drop-down list here select the media type, e. g. application/1bk.
— everything
If you want to flush the cache completely, make sure this radio button
is checked. The radio button is checked by default..
After specifying the appropriate settings, use the following item to complete
the flushing procedure:
• Flush
Click on this button to perform the flush.
4–19

Proxies
Chapter 5
The functions described in this chapter are accessible over the Proxies
tab of the Web interface:
They allow you to set up Webwasher for running as a proxy server or an e-mail
gateway, for communicating with the ICAP server, and for using the IFP or
WCCP protocol.
Note that two more functional groups are available here when the license that
Webwasher is running with does not include the Anti-Spam product:
• Queue Handling
• Message Handling
These are usually available under the Anti Spam tab, which is then not visible.
If they are available under the Proxies tab, corresponding buttons are added
to the navigation panel on the left side of the interface area.
They are grouped there with the E-Mail-Gateway buttons.
For a description of these functions, see sections 4. 11 and 4.12 of the User’s
Guide Webwasher Anti-Spam.
The upcoming sections describe how to handle the functions of the Proxies
tab. The description begins with an overview.
5–1

Proxies
5.1
Overview
5–2
The following overview shows the sections of this chapter:
System Configuration Guide – Webwasher Web Gateway Security
Introduction
User Management
Reporting
Caching
Proxies Overview –thissection
Configuration
Web Proxies HTTP Proxy, see 5.2
HTTPS Proxy, see 5.3
FTP Proxy, see 5.4
E-Mail Gateway E-Mail Gateway, see 5.5
Delivery Options, see 5.6
Queue Configuration, see 5.7
Relay Protection, see 5.8
Exception Lists, see 5.9
Load Limits, see 5.10
POP3 Access, see 5.11
Queue Handling
These functions are available here when the
Anti-Spam product is not included in your
license, see the beginning of this chapter.
Message Handling
The information provided under Queue
Handling applies here as well.
ICAP Server ICAP(S) Server, see 5.12
Other Protocols IFP, see 5.15
Progress Indication Methods, see 5.13
Own Host Name, see 5.14
WCCP, see 5.16
Note that the options described in this section
are only available in an appliance version of
Webwasher

5.2
HTTP Proxy
Proxies
The HTTP Proxy options are invoked by clicking on the corresponding button
under Proxies:
If you want to enable any of these options, make sure the checkbox on this
button is also marked. The checkbox is marked by default.
After modifying the setting of this checkbox, click on Apply Changes to make
the modification effective.
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Settings, see 5.2.1
• Next Hop Proxies, see 5.2.2
• Authentication, see 5.2.3
• ICAP Services, see 5.2.4
• Transparent Setup, see 5.2.5
Note that this tab is only available for appliance versions of Webwasher.
5–3

Proxies
5.2.1
Settings
5–4
The Settings tab looks like this:
There are four sections on this tab:
• Port Settings
• Proxy Options
• Timeout Prevention
• IP Forwarding
They are described in the following.

Port Settings
The Port Settings section looks like this:
Proxies
This section displays a list of the ports that are opened by Webwasher as listener
ports for the ICAP client when Webwasher is configured as an HTTP
proxy.
Note that this section is also used for configuring Webwasher as HTTPS proxy.
You can add entries to the list and edit or delete them.
The default port has the port number 9090. This port is entered by default in
the list and cannot be deleted. You may, however, change the port number.
Use the following button to add a port to the list:
• Add Proxy Port
Click on this button to open a window where you can specify information
on a new listener port and enter it in the list.
For a description of this window, see the Port Settings subsection below.
The following information is provided in the list for each listener port:
• Address
IP address and port number of the listener port.
The specification of the IP address is optional and may therefore not be
displayed here.
• Allow access from
IP addresses of the sites that should have access to the listener port.
An * in this field means that every site is allowed access.
5–5

Proxies
5–6
• Policy
Policy that will be applied during communication with the ICAP client over
the listener port.
This is not part of the authentication process for a client, but of the policy
mapping that maps this client to a particular policy.
If no policy is selected here, there will be no particular policy for communication
with a client over this listener port. Instead, the policy that was
configured for the ICAP server will be used.
• Transparent Proxy
Information whether Webwasher is configured as a transparent proxy during
communication with the ICAP client over the listener port.
• HTTP Caching
Information whether the caching feature is enabled. This feature is enabled
by default.
Note that the feature is only available with appliance versions of Webwasher.
Otherwise, this checkbox is not displayed here.
To edit an entry, type the appropriate text in the input fields of the Address and
Allow access from columns, select a policy from the Policy drop-down list in
the same line and mark or clear the corresponding Transparent Proxy and
HTTP Caching checkboxes as required.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Use the following item to delete entries that are in the list:
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next to
it and click on this button. You can delete more than one entry in one go.
To delete all entries, with the exception of the default listener port, mark the
Select all checkbox and click on this button.

Port Settings
Proxies
The Port Settings window opens after clicking on the Add Proxy Port button.
It looks like this:
Using this window you can add a port to the list of listener ports that are opened
by Webwasher for communication with the ICAP client when Webwasher is
configured as HTTP or HTTPS proxy.
Use the following items of this window to configure the port settings and add
the port the list:
• Port
In this input field, specify the IP address and the port number of the port.
The input format is:
[IP]: port
Note that for security reasons, Webwasher runs under plain user rights (as
opposed to root rights). Hence you can’t choose a privileged port (below
1024) at runtime.
If you choose a privileged port, you have to restart Webwasher to make it
available.
• Allow access from
In this input field, specify the IP addresses of the sites that should have
access to the listener port. The input format is:
(IP|IP/NetMask|IPrange)[,(IP|IP/NetMask | IP range)]*.
Entering an * in this field means to allow every site access.
5–7

Proxies
5–8
• Use Policy
From the drop-down list provided here, select a policy that will be applied
during communication with the ICAP client over the listener port..
• Serve non-proxy requests (transparent proxy)
Mark this checkbox to configure Webwasher as transparent proxy during
communication with the ICAP client over the listener port.
• Use Port for HTTP Caching
If you want to use the port you are configuring here for HTTP caching, make
sure this checkbox is marked. The checkbox is marked by default.
Note that this item is only displayed with appliance versions of Webwasher.
• Add
After specifying the appropriate information about a listener port, click on
this button to add it to the list.
If the addition was successful, a corresponding message is displayed in
this window. You can then go on to add another port to the list.
• Close
Click on this button to close the window and return to the Settings tab.
Proxy Options
The Proxy Options sectionlookslikethis:

Proxies
Using this section, you can specify a number of settings for the ICAP client
communicating with Webwasher when it is configured as HTTP proxy.
Note that this section is also used for configuring Webwasher as HTTPS proxy.
So, whenever HTTP is mentioned in the following, the statement in question
is valid also with regard to an HTTPS configuration.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure these proxy options:
• ... retries on server overload when connected directly
Select a number from the drop-down list provided here to configure how
many times a retry will be performed over a direct connection when the
server is overloaded.
• Add ’Via’ header to HTTP header
Select this option to let Webwasher add a Via header to the REQUEST
and RESPONSE headers.
The Via header is used to track message forwards, avoid request loops,
and identify the protocol capabilities (HTTP 1.0 or 1.1) of all senders along
the request/response chain.
• Treat FTP over HTTP as native FTP
If this option is enabled, while Webwasher is being used as a proxy server,
no user data will be transmitted, unless username and password are already
provided by the URL
There are two kinds of FTP requests: those coming from a native FTP client
using the real FTP, and those coming via HTTP but for URLs beginning with
ftp://.
For the latter, the last HTTP proxy in the chain has to convert the HTTP
commands into native FTP in order to connect to the FTP server. Webwasher
can establish direct connections, as well as make use of parent
HTTP and FTP proxies.
Native FTP requests will always use the configured next hop FTP proxy (if
any) or direct FTP connections.
FTP request over HTTP usually check for the HTTP proxy settings and use
the next hop HTTP proxy (if any) or direct FTP connections.
5–9

Proxies
5–10
Enabling the present option will change this behavior and let an FTP request
that came in via HTTP use the next hop FTP proxy settings, while
the next hop HTTP proxy settings are ignored.
This means that these requests will use the configured next hop FTP proxy
(if any) or direct FTP connections.
• Persistent connection timeout
In the input field provided here, enter the time interval (in seconds) for a
persistent connection timeout.
If this interval elapses without any communication activities having occurred
on the connection between Webwasher and the client, the connection
is closed down.
• Dead client timeout
In the input field provided here, enter the time interval (in seconds) for a
persistent connection timeout.
If this interval elapses without any communication activities having occurred
on the connection from the side of the client, the connection is closed
down.
• Maximum header length
In the input field provided here, enter the maximum length (in bytes) for the
header of a request sent by the client to Webwasher.
If this length is exceeded, the request is denied by Webwasher.
• Ports allowed for CONNECT requests
In the input field provided here, enter the port or ports you want to allow for
CONNECT requests. Separate multiple entries by commas.
To allow all ports for CONNECT requests, enter an *.
Note that CONNECT is the only method used to connect to the HTTP port
of 443.
Port 443 is the port that an SSL server usually listens on. There are, however,
SSL servers that will not listen on this port.
In this case, you also need to modify the global.conf (global.ini) configuration
file in order to enable communication. Enter the following line in the
file:
PortsTreatedAsSSL=’443, ’

Then restart Webwasher to make the modification effective.
Timeout Prevention
The Timeout Prevention section looks like this:
Proxies
Using this section, you can configure methods for preventing timeouts on client
connections.
Webwasher tries to forward data as soon as it becomes available, but there are
situations in which this philosophy does not hold: an antivirus scanner needs
to see the complete file for many file types before it can scan for viruses.
This means that the HTTP proxy server cannot forward any data to the browser
until the complete file is received on the gateway and the scan process is complete.
Depending on the length of the file and the network connection, it can take a
long time, while a browser connection could even time out (other third-party
ICAP servers attached to the HTTP proxy RESPMOD pipe could also show
the behavior of not returning any data before the complete file is received).
For situations such as these, Webwasher provides methods for preventing
timeouts, by sending either an empty line or an HTTP header line every n
seconds. This feature should be used depending on your network configuration
and your filter settings.
The Timeout Prevention feature is not enabled by default. To enable it mark
the checkbox next to the section heading. After configuring its settings, click
on Apply Changes to make them effective.
Use the following items to configure timeout prevention:
• Webwasher should send every . . . seconds
Enter the number of seconds here to determine the frequency of applying
the methods configured below.
• an empty line
This method sends empty lines before the HTTP response.
5–11

Proxies
5–12
It works with many Internet browsers, but could fail with intermediate proxy
servers (between Webwasher and the client) because it does not strictly
follow the HTTP standard protocol.
• an HTTP header line
This method is fully backed by the HTTP standard. According to this, the
first line of the reply header (the status line) is sent at the beginning, and
then some additional header lines are sent to keep the connection alive.
There is, however, no guarantee that all intermediate proxies accept a
header that is split into many TCP frames.
A second disadvantage is that Webwasher already replied with a special
status code and is not able to change this again, e. g. after a virus was
detected.
In this case, the user would see an error message, but it would be transferredwitha200
OK reply code, which is not ideal.
IP Forwarding
The IP Forwarding sectionlookslikethis:
Using this section, you can configure the forwarding of a client IP address.
Another proxy in the chain may need information about this address. So, you
can tell Webwasher to include the client IP address as an HTTP header field.
This will determine where the client IP address is forwarded, e. g. to the next
hop proxy, Web server, etc.
The IP Forwarding option is not enabled by default. To enable it, mark the
checkbox next to the section heading. After specifying a header field name,
click on Apply Changes to make this setting effective.
Use the following input field to configure IP forwarding:
• as . . . header
Enter the header field name here that will determine where a Client IP address
is forwarded.
By default, this field name is X-Forwarded-For.

5.2.2
Next Hop Proxies
The Next Hop Proxies tab looks like this:
There is one section on this tab:
• Use Next Hop Proxies
It is described in the following.
Proxies
5–13

Proxies
5–14
Use Next Hop Proxies
The Use Next Hop Proxies section looks like this:
Using this section, you can configure next hop proxies for HTTP connections.
You can specify the URLs that next hop proxies should be used for, as well as
the mode of this usage and the next hop proxies to be used.
The Use Next Hop Proxies feature is not enabled by default. To enable it,
mark the checkbox next to the section heading. Then click on Apply Changes
to make this setting effective.
Furthermore, use the following items to configure next hop proxies:
• Do not use Next Hops for local addresses
Enable this option to prevent the use of next hop proxies for local addresses.
Then click on Apply Changes to make this setting effective.
Local addresses have no dots (.) within their specifications.
So, after enabling this option, you can fine-tune Webwasher in an intranet
and enter the name of a local server in the browser, e. g. server_name,
instead of typing a URL, e. g. http://server_name.fooo.com.
Webwasher will then contact this local server directly without using the configured
proxy.
Using this option speeds up internal connections and reduces load on the
proxy server.

• if URL matches
Proxies
This input field is the first of severals items provided for specifying information
on the next hop proxies you want to configure.
Enter a matching term here. If an URL matches this term, it will use the
next hop proxies specified further below in the usage mode that is also
specified further below.
• use mode
From this drop-down list, select the mode to be used for the URLs and next
hop proxies specified here. The following modes are available:
— None
This mode uses no next hop proxies. Direct connections will be used
instead.
— specific
In this mode, one specific next hop is set for the URLs configured
above.
— failover
In this mode, the first next hop given in the participants list is tried first.
If it fails, it will be retried until the configured retry maximum for it has
been reached.
Then the second next hop proxy in the participants list is tried, etc.
— round robin
In this mode, the next hop proxy is used that is next in the participants
list to the one that was used last.
This means also that the participants is used in a circular manner: If
the end of the list has been reached, selection of next hop proxies will
restart from the beginning.
• participating next hops
In this input field, enter the next hop proxies that should be used for the
URLs specified here.
To do this, type a proxy name or select one from the drop-down list to the
right of this input field. You can add more than one proxy by repeating this
operation.
The drop-down lists shows select one to add as its topmost entry. If no
next hop proxies have been configured yet, the topmost entry reads no
Next Hops defined.
5–15

Proxies
5–16
To configure next hop proxies, click on the Define Next Hop Proxies
button, which is located further to the right.
This will open a window, where you can specify the information required to
configure a next hop proxy.
For the description of this window, see the Available Proxies subsection
further below.
• Add Entry to List
After specifying the appropriate information about a next hop proxy, click
on this button to add it to the list.
The list of next hop proxies is displayed at the bottom of this section. For each
entry, it provides the information that is specified when a new entry is added.
You can edit list entries, move them up and down in the list, or delete them.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key on your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input fields of the URL, use
mode and participating next hops columns. Then click on Apply Changes
to make this setting effective. You can edit more than one entry and make the
changes effective in one go.
The list also contains an entry with * as value for the URL parameter. It is
always in last position within the list and cannot be deleted. By editing this
entry, you can configure a next hop proxy setting for all URLs that are not
represented by a particular entry in the list.
Since the * entry is last in the list, it becomes effective only after all other list
entries were read by Webwasher and used for establishing next hop proxy
connections.
By default none is specified as mode for the * entry, which means that there
will be no next hop proxy connections for URLs that are not otherwise included
in the list.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field above the URL, use mode or
participating next hops or in a combination of them and enter this using
the Enter key of your keyboard.

The list will then display only entries matching the filter.
• Delete Selected
Proxies
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there is
more than one entry in the list containing information on a particular URL
or next hop proxy, the entry that is first in the list wins.
Available Proxies
The section in this window allows you to configure next hop proxies for all kinds
of connections. These will then be available for selection on the Use Next Hop
Proxies tab.
After specifying the appropriate settings for a next hop proxy, it is added to the
list of available next proxies by clicking on the Add button.
The list is displayed at the bottom of the section. You can modify the settings
for each proxy that is shown in the list.
Use the following items for configuring available next hop proxies:
• Name
In this input field, enter the name of the next hop proxy you want to configure.
If you leave the field empty, a name will be generated by Webwasher,
e. g. pxy1, and inserted in this field after clicking on the Add button.
The name can be modified after the new proxy has been included in the
list.
• Proxy server address
In the input fields provided here, enter the address of the server you want
to make available as next hop proxy:
— Host
Enter the IP address or URL of this server here.
5–17

Proxies
5–18
— Port
Enter the port number of the port for connecting to this server here.
• Proxy authorization
In the input fields provided here, enter the credentials that Webwasher
should use for authentication at the next hop proxy:
— Username
Enter the IP address or URL of this server here.
— Password
Enter the password here.
• Connection behavior
Use the items provided here to configure the connection behavior:
— Retry . . . times on failure for this proxy
From the drop-down list provided here, select the number of retries you
want to configure for a next hop proxy. You can configure up to three
retries.
When the maximum number of retries has been reached, Webwasher
will try to establish a connection using another next hop proxy, according
to what has been configured on the Use Next Hop Proxies tab,
e. g. failover or round robin.
— Donotretryproxyfor...minuteswhenithasreached...
times within 10 seconds its maximum number of retries
In the input fields provided here, enter the time information that will
cause a connection break, i. e. an interval during which Webwasher
will not retry a next hop proxy after a connection to it could not be established
in a given situation.
In the first input field, enter the time (in minutes) that the connection
break should last.
In the second input field, specify how often the maximum number of retries
must have been reached within 10 seconds before the connection
break is started.
— use persistent connections
If you want Webwasher to use persistent connections to the next hop
proxies, make sure this checkbox is marked. The checkbox is marked
by default.
Webwasher will try to meet this requirement by establishing persistent
connections, but may fail to do so in some situations.

• Add
Proxies
You will then see that the failed counter in the list of available next
proxies displays an increased value for the connection to the next hop
proxy in question.
In this case, you might clear the checkbox to disable the option. Note,
however, that this will reduce performance.
After specifying the appropriate information for the server you want to make
available as next hop proxy, click on this button to add it to the list of available
next hop proxies.
The list of available next hop proxies is displayed at the bottom of this section.
For each entry, it provides the information that is specified when a new entry
is added. Furthermore statistical figures are displayed on the reliability of next
hop proxies.
You can edit list entries, delete them and reset the statistics.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, click on the View Details and Edit link in the same line. This
will reopen the window and this section with the information concerning the
next hop proxy in question, so you can modify it.
After completing the modification, click on the Modify button, which is provided
now instead of the Add button, to make it effective. If you want to clear the
information before modifying the settings for a next hop proxy, click on the
Clear Input button.
Apart from the information that was specified when a new entry was added to
the list, such as the proxy name and address, the list displays statistical figures
on the reliability of each next hop proxy.
The following information is provided in the columns of the list:
• reliability
Reliability of a next hop proxy
The reliability is calculated as the percentage of attempts to establish a
connection to the next hop proxy that were successful in relation to the
overall number of attempts.
5–19

Proxies
5–20
• tried
Number of times that Webwasher tried to establish a connection to a proxy
• failed
Number of times that an attempt by Webwasher to establish a connection
toaproxyfailed
• last fail
Date and time of the last time that an attempt by Webwasher to establish
a connection to a proxy failed
• do not retry reached
Date and time of the last time that a situation was reached where Webwasher
did not retry a next hop proxy over a given period of time.
The length of this period depends on what you configured under Do not
retry proxy for . . . minutes when it has reached . . . times
within 10 seconds its maximum number of retries, see above.
If the do not retry situation is still on, i. e. Webwasher will currently not retry
the next hop proxy in question, the date and time values are displayed in
red.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input fields above the Name, Proxy or Port
columns or in a combination of them and enter this using the Enter key of
your keyboard. The list will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Reset Statistics
Click on this button to reset the statistical figures shown in the list for reliability
of next hop proxies.
• Reset do not retry
Click on this button to reset the statistics only for the do not retry reached
parameter, see above.

To return to the Next Hop Proxies tab, click on the Close button.
Proxies
The next hop proxy you added to the list, will also appear and be available in
the list of next hop proxies, which is displayed at the bottom of the Use Next
Hop Proxies section on that tab.
5.2.3
Authentication
The Authentication tab looks like this:
At the top of this tab, there is a button labeled:
• Define Proxy Authentication Options
Click on this button to configure some additional options relating to all kinds
of proxies. This will open a window where you can specify the appropriate
information.
It is described after the Configuring the eDirectory Authentication
Method subsection (see below).
Furthermore, there are five sections on this tab:
• Authentication Process
• Authentication Options
5–21

Proxies
5–22
• NTLM and NTLM-Agent Authentication Options
• User Database Authentication Options
• IP Forwarding
They are described in the following.
In addition to this, a sample procedure is described for the eDirectory authentication
method, after the Authentication Process subsection:
• Configuring the eDirectory Authentication Method
This is followed by the Define Proxy Authentication Options subsection
that was already mentioned above.
Authentication Process
The Authentication Process section looks like this:
Using this section, you can configure where users are authenticated. The authentication
process may involve an LDAP or NTLM server, a Radius server,
or the User Database provided by Webwasher.
Furthermore, there is also an option for configuring the use of a Novell eDirectory
server, which will then take the role of an LDAP server, in order to
authenticate users.
On this server, information is stored about the IP addresses of authenticated
users, which can be extracted and used by Webwasher for the authentication
process.
The name of the field where the IP address of a user is stored is
NetworkAddress. The port number can be stored there with the address.
The field is in binary format, which means that no wildcard queries can be performed
for user addresses. Instead, Webwasher periodically polls the eDirectory
to retrieve the addresses of the users that logged in since the last request.
The structure of this search is reflected in a filtering term, which is configured
together with the settings for the LDAP method, see further below.
Make sure the NetworkAddress field is visible when the user information is
looked at via the LDAP server interface. Otherwise, Webwasher will not be
able to extract the information.

Proxies
You can select two of the methods mentioned above and configure them for
user authentication here. The methods are applied in the order you configure
them.
A user is successfully authenticated as soon as one of the configured methods
produces a match.
After selecting a method, you can specify further settings that are relevant to
this method in other sections of this tab, and in the window that appears after
clicking on the Define Proxy Authentication Options buttoninthetoparea
of this tab.
For the NTLM and NTLM-Agent methods, this can be done in the NTLM and
NTLM-Agent Authentication Options section, and for the User Database
method in the Userdatabase Authentication Options section. Both these
sections are on this tab.
For the LDAP method, there is the LDAP Authentication section in the Define
Proxy Authentication Options window, where you also find the Radius Authentication
section for the Radius server method.
If you select eDirectory as method, you can also configure the use of a filter
for searching the user information that is needed in the authentication process.
This is done in the Novell eDirectory IP Filter input field, which is provided
in the LDAP Authentication section of the Define Proxy Authentication
Options window.
A filtering term has been entered in this field, which should not be altered since
this will prevent Webwasher from extracting the appropriate user information.
The name of the storage field on the eDirectory server has also been preconfigured
as one of the additional settings of the LDAP method and should likewise
not be altered.
Furthermore, you can configure the eDirectory option as part of the Web mapping
process. There will be a lookup of these addresses then on the eDirectory
server before they are mapped to security policies configured within Webwasher.
Use the Mapping Process section on the Web Mapping tab under User
Management > Policy Mapping to configure these settings.
After specifying the appropriate settings here, click on Apply Changes to
make them effective.
Use the following drop-down lists to configure user authentication:
• Authentication methods list 1
Select a method for user authentication from this drop-down list.
5–23

Proxies
5–24
If you select an additional method from the second list, they are applied
according to their order. If the first method fails, a user may still be authenticated
by the second.
The following methods are available: NTLM, NTLM Agent, LDAP, eDirectory,
User Database and Radius.
• Authentication methods list 2
Select a method for user authentication in the same way as described
above from this drop-down list.
You may also select None here, and have just one method for authenticating
users.
Configuring the eDirectory Authentication Method
The following procedure describes how to configure an authentication method
that uses the information stored on a Novell eDirectory server.
This method is then configured as part of a Web mapping that maps users of
a given group to a particular policy.
It is also shown how to specify the appropriate settings for the LDAP server
configuration.
Proceed as follows:
1. In the Authentication Process section of the Authentication tab, select
eDirectory as method from the first drop-down list.
2. Click on Apply Changes to make this setting effective.
3. Go to the Web Mapping tab under User Management > Policy Management.
4. In the Mapping Process section of that tab, set up a mapping method
that maps users based on their IP addresses and using the eDirectory
authentication method.
To do this, select the following in the first line under Mapping Order for
REQMOD:
• From the Map from drop-down list, select IP.
• From the Map via drop-down list, select via eDirectory.
The resulting scheme is then displayed under Using these rules.
5. Click on Edit rules and options in the same line. This will take you
to the IP based mapping tab, where you can set up mapping rules for
authenticated users.

Proxies
6. On this tab, leave the default settings of the first three sections as they
are.
Note that using the Standard Meta (ICAP) Header (X-Client-IP) for the
IP address search will work fine as long as Webwasher is configured as
proxy.
7. In the Add Rule section, add a rule that maps the users of a given group
to a particular policy:
• Select a policy from the drop-down list provided here, e. g. edirpolicy.
If no existing policy suits your needs, configure a new one, using the
Create New Policy section on the Management tab under User
Management > Policy Management.
• Type the name of the user group in the input field next to the list, e. g.
edirgroup.
The users of this group must be stored on the eDirectory server together
with information specifying the group.
8. Click on Add First to add the rule to the rules list, which is displayed
below the Add Rule section under Current Rules.
9. Click on Configure LDAP Server at the top of this tab, to go to the
LDAP Connection tab, where you can configure the eDirectory server
that takes the role of an LDAP server in this configuration.
10. On this tab, enter the following in the LDAP Connection Details section:
• In the LDAP server(s) field, type the host name or IP address of the
eDirectory server.
• In the WW’s user name field, specify a user name, e. g. admin,
and where to begin the search for it in the eDirectory, e. g. under
edirfolder. Use the format required for LDAP configuration: cn=admin,
o=edirfolder.
• IntheWW’s password field, type a password for the user name configured
above.
11. In the Attribute Details section, proceed as follows:
• Leave the User checkbox blank and mark the Group object checkbox.
This setting is required to configure group-based mapping, which this
procedure is about. To configure user-based mapping, do it the other
way round.
Note that you cannot configure both kinds of mapping at the same
time.
For user-based mapping, you would also have to leave cn as value
in the Attributes to extract field, see below.
5–25

Proxies
5–26
• Make sure that cn is the value in the Attributes to extract field.
According to the LDAP format, this is the code for the attribute that
contains the group name in a search for user groups (or the user name
in a search for individual users). It is also the default value here.
• In the Base DN to group objects field, specify where to begin the
search for the users of a given group within the eDirectory, e. g. under
edirfolder.
Use the LDAP format again: o=edirfolder.
• In the Group member attribute name field, leave uniquemember,
and in the Object class for groups field, leave groupofuniquenames
as default values.
12. In the LDAP Authentication section, enter the following:
• IntheBase DN to user object field, type o=edirfolder again. Note
that this setting and the following are also required for user-based
mapping.
• In the UID attribute name field, type cn.
13. Click on Apply Changes to make these settings effective.
This completes the sample procedure.
You can now login as user of a group, e. g. edirgroup, that is stored on the
eDirectory server, e. g. under edirfolder, to see if the mapping was performed
successfully.
The mapping was successful if you can now access Web objects as is allowed
under the settings of edirpolicy.

Define Proxy Authentication Options Window
The Define Proxy Authentication Options window looks like this:
Proxies
It enables you to configure further settings for some of the authentication methods
that are configured in the Authentication Process section.
These settings are valid for all kinds of proxies and also for transparent authentication.
There are four sections in this window:
• NTLM Agent Setup
• LDAP Authentication
• Radius Authentication
• Login Window Name
They are described in the following.
5–27

Proxies
5–28
NTLM Agent Setup
Webwasher can run on Microsoft Windows as well as on other operating systems
such as Linux or Solaris. If it is running on Windows, it can directly do
NTLM authentication with the domain controller.
If you want to use NTLM authentication with Webwasher on a different operating
system, you can do this via Webwasher’s NTLM Agent.
The NTLM Agent may also be useful for Windows deployments if the connection
between Webwasher and the domain controller is limited by a firewall,
because the connection to this agent requires only a single free definable port
to be opened.
The NTLM Agent is an application you can download from the Resource Center
(or the Webwasher Extranet). It must be installed on the domain controller or
on any other system of the domain that can communicate with the domain
controller via NTLM.
You can set up more than one NTLM Agent for high availability and/or to handle
NTLM authentication with multiple separated domains.
Webwasher is using a proprietary protocol to communicate with the NTLM
Agent. By default, connections to the NTLM Agents are encrypted. This can
be changed by unchecking the checkbox labeled Use encrypted connections
to NTLM Agents within the NTLM Agent Setup section.
If the clients use NTLM challenge response with Webwasher, no passwords
are transmitted, but only the response to the challenge. The request still contains
the user name and possibly group information.
If the clients use Basic authentication with Webwasher, the password is transmitted,
and Webwasher passes it on to the NTLM Agent.
We therefore recommend to use encrypted connections with the NTLM Agent.
The SSL connection switch is common to all NTLM Agents specified.
You must also switch off the SSL connection switch at the NTLM Agents to get
a successful connection.
The status of the NTLM Agent connections is shown on the corresponding Web
interface page and (in case of an error) also on the home page of this interface.
In case of an error, more status information may be available in the errors log
file and at the NTLM agent’s user interface.
If the NTML Agent is not running on the domain controller, you should make
sure that the service pack version installed on the system it is running on is the
same as that on the domain controller.

To set up an NTML Agent, proceed as follows:
Proxies
1. Within the Web interface, go to the Authentication tab under Proxies
> HTTP Proxy.
2. In the Authentication Process section, select NTML-Agent as authentication
method.
This option is offered in each of two drop-down lists. Priority will be given
to the authentication method selected from the first list.
3. Specify a list of the NTLM Agents that Webwasher should connect to.
To specify an NTML Agent, enter the IP address of the system running
this agent in the input field within the NTML Agent Setup section.
Also specify a port number in case the default port 9531 is not used.
Example 1: 192.168.42.100 (specifies a connection to the NTLM Agent
running on 192.168.42.100 on default port 9531).
Example 2: 192.168.42.101:1234 (specifies a connection to the NTLM
Agent running on 192.168.42.101 on port 1234).
If you are deploying multiple NTLM Agents for the same domain, list their
IP addresses and ports in a comma-separated list.
Example 3: 192.168.42.100,192.168.42.101:1234
Webwasher will use a round robin load balancing scheme to connect to
these agents.
If you want to use a list of NTLM Agents only for a special domain, type
the @ sign and the domain name after the NTLM Agents list.
Example 4: 192.168.42.100,192.168.42.101:1234@example.org.
If the domain name is omitted, the agents of the list are connected for all
domains that are not specified in other lists.
To separate multiple NTLM Agents domain lists, use the ; (semicolon).
Example 5: 192.168.42.100,192.168.42.101:1234@example.org;
192.168.42.200@example2.org;102.168.42.222:2345
This example will use the two agents on the systems with IPs .100 and
.101 in round robin load balancing with all requests for the example.org
domain. It will use the agent on the system with IP .200 for the example2.org
domain, and the agent on IP .222 for all other domains.
If you are deploying multiple NTLM Agents for the same domain, list their
IP addresses and ports in a comma-separated list.
5–29

Proxies
5–30
Example 6: 192.168.42.100,192.168.42.101:1234.
4. Click on Apply Changes to make your settings effective.
LDAP Authentication
Using this section, you can configure a number of settings that are needed
when LDAP is used as a group policy method for authentication on the ICAP
server and HTTP proxy.
Note that the ICAP client usually receives a list of attributes from the LDAP
server and the ICAP server only assigns a policy. But if you select LDAP as
authentication method on the ICAP server, this data will be retrieved twice, first
by the HTTP proxy and then by the ICAP server.
Configuring the settings as described below enables you to avoid this doubled
effort.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the items in the following two areas to configure LDAP authentication settings:
• Specify connection details
In this area, use the following input fields to enter details of the connection
to the LDAP server:
— LDAP server(s)
Enter the host name or IP address of the LDAP server here. The port
number may also be specified, after a colon, e. g. 192.168.0.5:389.
You can specify more than one server, separated by spaces. In this
case, Webwasher will try to perform load balancing based on a roundrobin
algorithm (all servers need to be configured in the same way for
this).
Note that no failover is performed by Webwasher. If Webwasher is
already running and an LDAP server is working, but then becomes unavailable,
a request to this server will fail.
If you start Webwasher and an LDAP server is not responding from the
beginning, it will be removed from the list and only the other servers
will be used.
— Username for Webwasher to log into LDAP server
Enter the name here Webwasher should use to authenticate itself when
trying to access the information stored on the LDAP server.

Proxies
If the server permits even an anonymous user to access this information,
no input is required here.
Note that when several instances of Webwasher are running in a cluster,
one of them is configured as master.
If the LDAP authentication method is used within this cluster, site instances
can only connect to the master if a user admin has been configured
for it.
This means that you need to enter admin as user name here if the
Webwasher instance you specify it for is the master of the cluster.
— Webwasher’s password
Enter the password here that goes with the user name specified for
Webwasher.
• Select where user attributes originate from
In this area, use the following input fields to specify where to look for the
attributes that are needed to authenticate a user:
— Base DN to user object
Enter the path name here that leads to the location where the search
for a user name entry should begin on the LDAP server.
— UID attribute name
If you want to use the UID attribute name, which is a unique key, in the
search for a user name entry on the LDAP server, make sure this radio
button is checked. The radio button is checked by default.
In the input field provided here, enter the key. If a user name submitted
for authentication matches this key, the user is authenticated successfully.
By selecting this option you enable a simple search relying only on the
attribute name.
To enable a complex search, use the Filter option described below, or
the Novell eDirectory IP Filter option (if you have configured eDirectory
as authentication method).
— Filter
If you want to enable a complex search for a user name entry on the
LDAP server, check this radio button.
This search is compatible with all kinds of LDAP servers, using query
filters for the following attributes: user name, user group name and
mail group name.
5–31

Proxies
5–32
In the input field provided here, enter a complex filter condition.
Example: A complex filter condition relying on the user name and the
user group name could be specified as follows:
(&(groupid=internet)(uid=%u))
With this sample condition, the user name needs to match the UID,
but it must also be a member of the internet user group, which might
have been configured to include all users that are allowed access to
the Internet.
All other users are blocked by the authentication process.
The variable used to represent the user name must be %u, as shown
above. No other variables are allowed here for this.
— Novell eDirectory IP Filter
A complex search for a user attributes on the Novell eDirectory server is
performed with the following filtering condition, which has been entered
in this field and should not be altered:
(&(objectClass=user)(loginTime>%u)
Within this condition, the %u variable represents the time of the last
update in the search for user attributes performed by Webwasher.
The complete condition searches for entries that are of the user object
class and have been stored since that last update.
— Novell eDirectory network address attribute
This attribute is the name of the field where the IP address of a user is
stored on the eDirectory server. It is NetworkAddress and must not
be altered.
Radius Authentication
Using this section, you can configure the connection to the Radius server,
where the user data is stored that can be looked up for authentication purposes.
The protocols supported on this connection are PAP/SPAP.
In order to enable a failover, you can configure a primary and a secondary
Radius server.
Furthermore, you can configure the use of group information within the authentication
process.

Proxies
Note that Webwasher does not use the failover configured here to do load
balancing, but only to perform a retry in case a problem occurs while authenticating
a user.
Depending on the type of problem, Webwasher proceeds in the following way:
1. If authentication fails, although communication itself went on correctly, e.
g. in case of a wrong password, no retry is performed.
2. If communication fails, e. g. when an error message was received after
sending the user credentials or a given time interval elapsed with no response
from the Radius server, the secondary server is tried using the
same credentials.
Note that the Radius server timeout is 5 seconds by default, and that it
cannot be configured within this Web interface, but only using the command
line interface.
3. Webwasher counts the number of errors that occurred on each server.
If the secondary server has fewer errors than the primary server, Webwasher
will try the secondary server first for the next instances of user
authentication.
After a given time, or if the error number ratio changes, Webwasher will
bring the primary and the secondary server back to their originally configured
order.
This procedure is only performed, however, when authenticating ordinary
users. Administrator authentication always starts with a fresh Radius
server setup, and the primary server is always tried before the secondary
server in this case.
In order to include information on the group that a user belongs to in the authentication
process, you can specify the appropriate attributes of the Radius
server response. This is done using coded values as they are defined in RFC
2865.
An attribute that is specified in this way may either be a simple attribute or a
vendor specific attribute.
According to RFC 2865, 25 is the value for the Class attribute, which may be
filled in the server’s response with a user group name. This is an example of
how a simple attribute could be used for the authentication process.
Note that the Radius server can also be configured to let a different attribute
with a different code value contain the group name, even if this code is not
defined in RFC 2865.
The code value defined for a vendor specific attribute in RFC 2865 is 26.
5–33

Proxies
5–34
However, for the structure of this attribute, it is only defined that it should begin
with the vendor ID (which is needed because there may be attributes belonging
to different vendors in a Radius server response) and that this ID should be
followed by a number of sub-attributes, the code values and content types of
which are defined by the vendor in question.
While it cannot be taken for granted that all vendors will actually adhere to
this sub-attribute structure, Webwasher is able to find all information contained
within the sub-attributes of a vendor specific attribute.
The value you need to configure for this is 0 (see also below).
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following input fields to configure the Radius server connection:
• Primary Radius server
Enter the server address and port number for the primary Radius server
here.
The input format is:
host[:port]
The default port is 1812.
• Secondary Radius server
Enter the server address and port number for the secondary Radius server
here.
The input format is:
host[:port]
The default port is 1812.
• Shared Secret
Enter the string here, e. g. password1, that should be used as password
for Radius authentication. Note that this password will be valid for both the
primary and the secondary server.
• Default domain name
Enter the name of the domain here that a user account should belong to
by default when Radius authentication is performed.
This may be the account of an ordinary user or an administrator account.

• GroupnameinRadiusresponseattribute
Proxies
Use the following items to specify the attribute that contains the user group
information in a response from a Radius server:
— no group name
If you do not want to include user group information in the authentication
process, make sure this radio button is checked. The radio button is
checked by default.
— value of attribute with code
Check this radio button to include user group information in the authentication
process that is contained in a simple attribute.
In the input field provided here, enter the value for the attribute code.
Enter, e. g. 25, to specify the Class attribute, as defined in RFC 2865,
but note that other codes may also be used here, even such as are not
defined in RFC 2865. The default code value is 0.
— vendor specific attribute with vendor ID
Check this radio button to include user group information in the authentication
process that is contained in a vendor specific attribute, consisting
of a vendor ID as main attribute and one or more sub-attributes.
In the input field provided here, enter the vendor ID.
The code value for this main attribute, which is 26, will then be added
by Webwasher. The default value in this field is 0, which means no
vendor ID is configured.
Note, however, that a vendor ID is required to provide any vendor specific
information.
— and sub-attribute type
In this input field, enter a numeric value to specify the type of subattributes
following the vendor ID.
Note, however, that a particular vendor may not use an attribute structure
consisting of sub-attributes.
To enable Webwasher to find all the information contained in a vendor
specific attribute, regardless of its structure, make sure 0 is entered
here. This is also the default value.
5–35

Proxies
5–36
Login Window Name
Using this section, you can configure the realm parameter in the header of an
authentication message Webwasher is forwarding to perform proxy authentication.
This parameter is also known as Login Window Name.
Furthermore, you can configure that a protocol is appended to the real parameter.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure the Login Window Name:
• Realm value
In this input field, enter the value for the realm parameter.
The default value is Webwasher.
• Append protocol to Realm
Mark this checkbox to have a protocol appended to the realm parameter.
Authentication Options
The Authentication Options section looks like this:
Using this section, you can configure options with regard to whether authentication
is required or not for a client and what to do in case the authentication
server is down.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following checkboxes to configure authentication options:
• Always authenticate client
Mark this checkbox to make authentication required for any client request.
Webwasher will then try to authenticate the client until it is successful or
until it finds that the authentication server is down. In this latter case, the
setting of the option described below will apply.

• Allow Internet access when authentication server is down
Proxies
Mark this checkbox to allow a client request in case Webwasher has found
that the authentication server is down.
NTLM and NTLM-Agent Authentication Options
The NTLM and NTLM-Agent Authentication Options section looks like
this:
Using this section, you can configure the NTLM authentication method, which
retrieves information that is stored in the database of a Windows domain controller
in order to authenticate users.
This method can be used by browsers, proxies and servers. It offers more
security than other methods because the user password can be transmitted in
an encrypted format.
You can also use an agent application, the NTLM Agent, for enabling this authentication
method. The settings that are configured here will also apply to
this agent application.
There is a basic and an integrated way of applying this authentication method.
With basic authentication, the client browser sends the user name and password
in plain text (less secure). Integrated authentication encrypts messages
going from the client browser to the server and back.
In the process of user authentication, Webwasher contacts the corresponding
domain controller and retrieves a list of global domain groups that this user is
a member of, or a list of local groups on the domain controller, or both.
You can also specify a default domain that is used to verify membership of a
user if no other information is available.
The ICAP server can retrieve information on user groups to perform policy
mapping. A list of these groups must be provided by the ICAP client.
Note that the user and user group information required for policy mapping
should not be stored in a subdirectory of the domain controller since it may
not be possible to retrieve it from there.
5–37

Proxies
5–38
It should be stored, e. g., in \company.com rather than in \company.com\e-mail
aliases.
Note also that if you are using the NTLM Agent, a tool like NTLMTest.exe will
enable you to view a list of the groups the domain controller actually sends to
the NTLM Agent, which forwards it to Webwasher.
Ask your support team for this tool and install it on the system the NTML Agent
is running on.
After specifying the appropriate information here, click on Apply Changes to
make your settings effective.
Use the following items to configure the NTLM and NTLM-Agent authentication
methods:
• Enable integrated authentication
If you want to use the integrated authentication method, make sure this
checkbox is marked. The checkbox is marked by default.
• Enable basic authentication
If you want to use the basic authentication method, mark this checkbox.
• Default domain
In this input field, type the name of the domain that should be used as
default in the process of user authentication.
• Select what groups to get from Domain Controller
From the drop-down list provided here, select what groups should be retrieved
from the domain controller: Global, Local or both.
User Database Authentication Options
The User Database Authentication Options section looks like this:
Using this section, you can configure authentication by means of using the
information stored in a user database.
There is a basic and an integrated method of authenticating users.

Proxies
With basic authentication, the browser sends the user name and password
as plain text (less secure) to Webwasher (who plays the role of the client to
exchange authentication messages with the authentication server), so Webwasher
uses the information stored in the user database to authenticate the
user.
Integrated authentication encrypts messages going from the client browser to
the authentication server and back. In this situation, Webwasher acts as the
proxy server and forwards authentication server messages to the client.
After specifying the appropriate information, click on Apply Changes to make
this setting effective.
Use the following items to configure this kind of authentication:
• Enable integrated authentication
Enable this option to use the integrated authentication method. This is the
default option.
• Enable basic authentication
Enable this option to use the basic authentication method.
IP Forwarding
The IP Forwarding sectionlookslikethis:
Using this section, you can configure the header that is forwarded to the ICAP
server and also to the Web server or next hop proxy if required.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following items to configure the forwarding of headers:
• IP from header ...
If you want the IP address that is forwarded to the ICAP server to be taken
from a particular header, make sure this checkbox is marked and enter this
header in the input field provided here.
The checkbox is marked by default. The default header is
X-Forwarded-For.
5–39

Proxies
• Client IP
5.2.4
ICAP Services
5–40
Mark this checkbox if you want to the IP address of the client to be forwarded
to the ICAP server.
The ICAP Services tab looks like this:
There are three sections on this tab:
• Services
• List of Available ICAP Services
• Bypass ICAP Server
They are described in the following.
Furthermore, there is a description of the ICAP Service Definition window
after the List of Available ICAP Services section:
• ICAP Service Definition Window

Services
The Services section looks like this:
Proxies
Using this section, you can configure the ICAP client services that should be
used for REQMOD and RESPMOD communication.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following input fields to configure ICAP client services:
• REQMOD services
Type the ICAP client services that should be used for REQMOD communication
in this field. If there is more than one service, separate them by the
| (pipe sign).
You can also enter a service by selecting it from the drop-down list next to
this input field.
• RESPMOD services
Type the ICAP client services that should be used for RESPMOD communication
in this field. If there is more than one service, separate them by
the | (pipe sign).
You can also enter a service by selecting it from the drop-down list next to
this input field.
List of Available ICAP Services
The List of Available ICAP Services section looks like this:
5–41

Proxies
5–42
It displays a list of the services that are available for being configured in the
Services section above.
To add a service to the list, click on the ICAP Service Definition link that is
provided here.
This will open a window for adding services. It is described in the upcoming
subsection.
ICAP Service Definition Window
The ICAP Service Definition window looks like this:
It allows you to add an ICAP service to the list and displays this list.
For these purposes, two sections are provided in the window:
• Add Service Name and URI
• Service Name List
They are described in the following.

Add Service Name and URI
Proxies
Using the section labeled AddServiceNameandURI, you can specify information
on an ICAP service and add it to the services list.
Note that the settings you configure here will apply to the HTTP, HTTPS and
FTP proxies, as well as to the e-mail gateway.
The services that are added here are particular ICAP services used in addition
to the internal services. These include services for virus scanning, content
filtering, as well as for Webwasher services on remote machines, e. g. when
load balancing is performed.
You can also configure services for use of the ICAP client set up.
When adding a service, a Uniform Resource Identifier (URI, also known as
URL) is specified.
This is a short string that identifies resources in the Web such as documents,
images, downloadable files, services, electronic mailboxes, and other resources.
It makes resources available under a variety of naming schemes and access
methods such as HTTP, HHTPS, and FTP, and makes e-mails addressable in
the same way.
Furthermore, you can configure additional options to enable bypassing in case
of connection errors, limit the use of an ICAP server when no message body
needs to be filtered, and ensure that not more connections are activated than
the ICAP server can handle at the same time.
Use the following items to specify and add a service:
• Service Name
In this input field, enter the name of the ICAP service.
• URIs
In this input field, enter one or more URIs for the service. Begin a new line
for each of them. The input format for a URI is:
icap://192.168.3.6:1344/wwreqmod
• Enable bypass on ICAP server error
Mark this checkbox to enable a bypass in case there is an error due to the
ICAP server connection.
5–43

Proxies
5–44
• Limit ICAP usage to encapsulated (HTTP(S)/FTP) requests/responses
that have a body
Mark this checkbox to limit the use of an ICAP server. The server will only
be used then for processing HTTP, HTTPS or FTP requests or responses
if these have a message body encapsulated.
This way, you can configure an ICAP service on a client for use with particular
Data Leakage Prevention (DLP) products that do not need to see
non-body traffic.
Note that enabling this option is well suited for ICAP communication in
REQMOD mode, where most messages have no body, but rather not in
RESPMOD mode.
Make sure, however, not to enable the option in REQMOD mode for an
ICAP service that is used under Webwasher.
This would have an impact on filtering since Webwasher filters such as
the URL Filter or the Generic Header Filter would then only be applied to
requests with a body.
• Respect max concurrent connections limit of ICAP server
Mark this checkbox to prevent Webwasher as ICAP client from setting up
more connections at the same time than the ICAP server is capable of
handling.
This maximum value is configured on the ICAP server and communicated
to the client when responding to an OPTIONS request.
• Add
After specifying the appropriate information for an ICAP service, click on
this button to add it to the list.
The list is displayed in the ServiceNameListsectionfurther below in
this window.

ServiceNameList
The ServiceNameListsection displays a list of the ICAP services.
Proxies
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, mark or clear the checkbox next to the service name in order to
activate or deactivate it, type the appropriate information in the corresponding
URIs input field, and mark or clear the Bypass enabled, Limit ICAP Usage,
and Respect Connection Limit checkboxes in the same line.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Note that you cannot change the settings for internal services, which are also
displayed in this list, except for the Bypass enabled and Limit ICAP Usage
options.
To close the window and return to the ICAP Services tab, click Close.
To edit an entry, type the appropriate text in the input field of the URIs column
and mark or clear the Bypass enabled checkbox.
Use the following items to perform other activities relating to the list:
• Filter
Type a filtering term in the input field of the Service Name or URIs column
or in both and enter this using the Enter key of your keyboard. The list will
then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
5–45

Proxies
5–46
Bypass ICAP Server
The Bypass ICAP Server section looks like this:
Using this section, you can configure a bypassing of the ICAP Server for requests
made to particular hosts. These hosts are entered in a bypass list.
To add a host to the list, use the input field provided here. Enter the IP address,
host name or URL, omitting http://.
Then click on the Add button.
The bypass list is displayed at the bottom of this section.
To display only a particular number of list entries at a time, type this number in
the input field labeled Number of entries per page and enter it using the Enter
key of you keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input field of the corresponding
line.
Then click on Apply Changes to make the modification effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field above the list and enter it using the
Enter key of your keyboard. The list will then display only entries matching
the filter.

• Delete Selected
Proxies
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
5.2.5
Transparent Setup
To delete all entries, mark the Select all checkbox and click on this button.
The Transparent Setup tab looks like this:
Note that this tab is only available for appliance versions of Webwasher.
There is one section on this tab:
• Packet forwarding
It is described in the following.
5–47

Proxies
5–48
Packet forwarding
The Packet forwarding section looks like this:
Using this section, you can configure the source IP address and port number
of the server that data packets should be forwarded, i. e. redirected to, by
Webwasher under the HTTP or HTTPS protocol.
The server addresses that may be specified here are the addresses of the
network interfaces of your Webwasher appliance.
You can also specify a source IP for traffic that should be included in the forwarding,
as well as a source IP for traffic that should be excluded.
To configure these settings may be useful when Webwasher is running on
your appliance as the default gateway that provides a proxy port for HTTP
and HTTPS clients.
This proxy port must be configured in transparent mode, which can be done
by adding it on the Settings tab under Proxies > HTTP Proxy with the Transparent
Proxy option enabled.
Under Allow access from, you can enter the IP addresses of the clients you
want to allow access over this proxy port, according to where you expect relevant
traffic from.
Note that Webwasher can only handle this kind of packet forwarding under the
HTTP and HTTPS protocols, i. e. not under protocols such as FTP or SMTP.
Furthermore, there are some limitations when using the SSL Scanner here.
For more information on these, see the next section.
If you want to use this feature, mark the checkbox next to the section heading.
After specifying this and other settings of this section, click on Apply Changes
to make them effective.

Proxies
Note that you also need to reboot the Webwasher appliance in order to let any
specification or modification of settings take effect.
A Reboot button is provided here for this purpose.
Use the following items to configure packet forwarding under HTTP and
HTTPS:
• Inbound device
From this drop-down list, select the interface that inbound traffic will use for
accessing the Webwasher appliance.
• Source IP include
In this input field, enter a source IP address for data packets that should
be redirected in any case.
A data packet will then be redirected only if its address matches the one
specified here and, furthermore, not the one specified under Source IP
exclude..
Input in this field is optional, but if it is entered, its format must be like this:
10.120.22.0/24
The last two digits are the network mask. You may also enter a part of a
source IP address.
• Source IP exclude
In this input field, enter a source IP address for data packets that should
not be redirected.
A data packet will then be redirected only if its address does not match
the one specified here and, furthermore, matches the one specified under
Source IP include.
Input in this field is optional, but if it is entered, its format must be like this:
10.120.22.0/24
The last two digits are the network mask. You may also enter a part of a
source IP address.
• Original destination ports
In this input field, enter the port numbers that data packets should have in
their destination addresses in order to be redirected.
Redirection will then be performed only for packets where the destination
addresses match one of the values configured here.
5–49

Proxies
5–50
If you enter more than one port number here, separate them by commas.
• Redirect to
From the drop-down lists provided here, select the IP address of the server
that packets should be redirected to, as well as a port number on this server.
You may choose from the addresses of all the interface devices the Webwasher
appliance is equipped with, as well as from the addresses of the
proxy ports that are currently configured.
The proxy ports are configured on the Settings tab under Proxies > HTTP
Proxy. Make sure to enable the Transparent Proxy option when configuring
a proxy there.
• Reboot
After specifying the appropriate information, click on this button to reboot
the appliance and make your settings effective.
Transparent SSL
This section provides additional information on the use of the SSL Scanner
when Webwasher is running on an appliance.
The SSL Scanner can be used on this appliance if Webwasher has been configured
to act as transparent proxy. Webwasher will be able to provide transparent
SSL scanner functions then if the corresponding data packets are redirected
to the proxy port.
This can either be achieved by using the WCCP protocol (Web Cache Communication
Protocol) or by configuring Webwasher as default gateway and enabling
the transparent proxy mode.
In this mode, the proxy port that the packages are redirected to will be able to
handle transparent requests.
Note that you need version 2 of WCCP if you want to use this protocol to enable
transparent SSL functions under Webwasher.
To configure a proxy port for handling transparent requests, go to the Settings
tab under Proxies > HTTP proxy.
In the Port Settings section of this tab, add a proxy port with the Transparent
Proxy option enabled.
By default, Webwasher will treat requests with original destination port 443 as
SSL encoded traffic.

Proxies
If you want to have Webwasher treat also requests with other destination
ports this way, you need to enter these ports in the global.ini (Windows) or
global.conf (Linux and Solaris) configuration file.
With these settings configured, Webwasher will add a pseudo-CONNECT
header to the address of the original destination host (original_dst_IP:
original_dst_Port) and pass this on to further processing.
When Webwasher issues a certificate, it copies the data from the original
server certificate.
The usual security measures, including decryption, certificate verification, content
scanning, and encryption, all work, but there are the following limitations:
• If the REQMOD server blocks the pseudo-CONNECT header, there will
usually be a Common Name mismatch in the certificate that Webwasher
returns.
The client asks for /www.name.de/, but gets the IP address back as
Common Name.
This may happen, e. g. when using the Webwasher URL Filter.
When transparent authentication has expired, there will even be two Common
Name mismatches:
— The REQMOD request will be blocked and the redirect to the authentication
server will contain the IP address (client requests name, but gets
IP address – first mismatch)
— After successful authentication, there will be a redirect to the IP address.
When executing this redirect, the REQMOD request will pass and Webwasher
will return a certificate with the copied subject name of the
server certificate (client requests IP address, but gets name – second
mismatch).
• Webwasher will not check the server certificate for a Common Name mismatch.
This check is disabled.
• As Webwasher copies the subject information from the original certificate,
the client may observe a Common Name mismatch (this would also be the
case without Webwasher).
• If the certificate check wizard is used to enter a certificate in the global
certificate list, this will only be found during filtering if entered via IP.
If there is an incident and you are using the incident manager to fill the lists,
e. g. by setting up a Block & Log Incident action, it will also be found.
5–51

Proxies
5.3
HTTPS Proxy
5–52
The HTTPS Proxy options are invoked by clicking on the corresponding button
under Proxies:
If you want to enable any of these options, make sure the checkbox on this
button is also marked. The checkbox is marked by default.
After modifying the setting of this checkbox, click on Apply Changes to make
the modification effective.
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Settings, see 5.3.1
• Next Hop Proxies, see 5.3.2
• Authentication, see 5.3.3
• ICAP Services, see 5.3.4

5.3.1
Settings
The Settings tab looks like this:
Proxies
There are six sections on this tab. These vary according to whether the instance
of Webwasher you are currently running is an appliance version or not:
• SSL Protocol Versions
• Supported Ciphers
• Transparent SSL Scanning Setup
This feature is only provided with appliance versions of Webwasher. It is
not shown on the above screenshot, but see the corresponding subsection
further below.
5–53

Proxies
5–54
• SSL Session Cache
• Proxy Options
• SSL Accelerator Card
This feature is not provided with appliance versions of Webwasher.
• Bypass SSL Scanner
The sections are described in the following.
Note that the same port settings and options are configured for Webwasher as
HTTPS proxy or HTTP proxy.
The Port Settings and Port Options sections are therefore not shown on this
tab, but can be navigated to using the HTTP Proxy Settings link at the top.
For a description of these sections, see 5.2.1.
SSL Protocol Versions
The SSL Protocol Versions section looks like this:
Using this section, you can configure protocol versions for SSL communication.
You can configure different protocols with regard to the communication between
a client browser and Webwasher, and between Webwasher and the
requested server.
After specifying the appropriate settings for both kinds of communication, click
on Apply Changes to make them effective.

Use the following checkboxes to configure protocols:
• TLS version 1
Proxies
This checkbox allows you to configure a protocol version for both kinds
of communication that can be described as follows: “The TLS protocol
provides communications privacy over the Internet. The protocol allows
client/server applications to communicate in a way that is designed to prevent
eavesdropping, tampering, or message forgery.“ (taken from RFC
2246).
This is the strictest of the protocol versions available here. If you want to
use it, make sure the checkboxes are marked accordingly. The checkboxes
are marked by default for both kinds of communication.
• SSL version 3
This checkbox allows you to configure a protocol version that is the current
standard for creating an encrypted link between a Web server and a
browser.
If you want to use it, make sure the checkboxes are marked accordingly.
The checkboxes are marked by default for both kinds of communication.
• SSL version 2
This checkbox allows you to configure an earlier version of 3.0. Since there
are several vulnerabilities with this version, its use is not recommended.
Supported Ciphers
The Supported Ciphers section looks like this:
Using this section, you can configure a cipher string. This may be used for
several of the activities that are performed in the process of SSL scanning,
such as encryption, exchange of keys and authentication.
Ciphers are symbols used for encrypting and decrypting the data traffic that is
conducted according to the SSL and TSL network protocols.
To read an explanation of the cipher string format and view a list of permitted
cipher strings, go to http://www.openssl.org/docs/apps/ciphers.html. This is
one of the Web pages provided by the OpenSSL project.
After specifying this setting, click on Apply Changes to make it effective.
5–55

Proxies
5–56
Use the following input field to configure a cipher string:
• Cipher list
Enter an appropriate cipher string here. For the string format, see the page
mentioned above. The default string is:
ALL:!ADH:+RC4:@STRENGTH
Transparent SSL Scanning Setup
The Transparent SSL Scanning Setup section looks like this:
Note that this section is only provided with appliance versions of Webwasher.
Using it, you can configure the ports that should be treated as SSL secured by
Webwasher.
After specifying this setting, click on Apply Changes to make it effective.
Use the following input field to configure SSL-secured ports:
• Ports treated as SSL
Enter the destination port numbers of the connections here that Webwasher
should treat as SSL secured.
Separate port numbers by commas.
SSL Session Cache
The SSL Session Cache section looks like this:
Using this section, you can configure the time period over which the settings
ofanSSLsessioncanbestoredinasessioncache.
Settings stored in a cache can be used to establish the corresponding connections
for further sessions. Using the stored settings will considerably reduce
the time needed for establishing a connection.

Proxies
After specifying this setting, click on Apply Changes to make it effective.
Use the following input field to configure a cache storing period:
• TTL ... seconds
Specify an appropriate storing time period (in seconds) here.
Proxy Options
The Proxy Options sectionlookslikethis:
Using this section, you can configure a number of settings for Webwasher
when it is configured as HTTPS proxy.
After specifying this setting, click on Apply Changes to make it effective.
Use the following drop-down list to configured these proxy options:
• ... retries on server overload when connected directly
Select a number from the drop-down list provided here to configure how
many times a retry will be performed over a direct connection when the
server is overloaded.
The default number is 2.
• Perform REQMOD request for CONNECT header
If a REQMOD request is performed:
— In a transparent environment, the IP address of a connection (not the
host name) will be inspected with regard to the informationstoredin
the URL Filter Database.
It may happen that the IP address is not categorized within that database,
whereas the host name is.
In this case, a request may be blocked in a transparent configuration,
but allowed in a proxy deployment.
— The request will only be done with the host or IP address as URL.
This may cause unexpected behavior if the host has a different categorization
than the accessed path.
5–57

Proxies
5–58
If a REQMOD request is performed:
• Contacting the Web server is always required, even for requests that are
blocked.
• The Tunneling by Category function is not available then, nor are hostbased
actions on the (global) certificate list.
• Some authentication scenarios require that the initial REQMOD request is
performed.
If you want to have a REQMOD request performed, make sure this checkbox
is marked. The checkbox is marked by default.
SSL Accelerator Card
The SSL Accelerator Card section looks like this:
Note that this section is not provided with appliance versions of Webwasher.
The section allows you to configure the use of an SSL accelerator card.
This may be helpful for time-consuming public-key cryptography operations.
Depending on the type of accelerator card and on your system, CPU load will
be reduced and speed may increase due to the additional hardware making
the public-key algorithm (also known as RSA) computations.
There are also SSL accelerator cards enabling you to store private keys.
After specifying this setting, click on Apply Changes to make it effective.
Use the following drop-down list to configure the use of an SSL accelerator
card:
• SSL Accelerator card used
Select the appropriate card from this list.
The default is None, i.e.nocardisused.

Bypass SSL Scanner
The Bypass SSL Scanner section looks like this:
Proxies
Using this section, you can configure a bypassing of the SSL Scanner for requests
that were sent from the hosts that are specified here.
There will be no decryption or certificate verification for these requests.
Specify a host you want to configure a bypass for in the input field provided
here. Enter a host name or an IP address, omitting HTTPS://.
Then use the following button to add the host to the bypass list:
• Add
Click on this button to add a host to the list.
The bypass list is displayed at the bottom of the section.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input field of the Connection
column. Then click on Apply Changes to make this setting effective. You can
edit more than one entry and make the changes effective in one go.
5–59

Proxies
Use the following items to perform other activities relating to the list:
• Filter
Type a filtering term in the input field of the Connection column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
5.3.2
Next Hop Proxies
5–60
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
The Next Hop Proxies tab looks like this:
There is one section on this tab:
• Use Next Hop Proxies
It is described in the following.

Use Next Hop Proxies
The Use Next Hop Proxies section looks like this:
Proxies
Using this section, you can configure next hop proxies for HTTPS connections.
You can specify the URLs that next hop proxies should be used for, as well as
the mode of this usage and the next hop proxies to be used.
The Use Next Hop Proxies feature is not enabled by default. To enable it,
mark the checkbox next to the section heading. Then click on Apply Changes
to make this setting effective.
Furthermore, use the following items to configure next hop proxies:
• Do not use Next Hops for local addresses
Enable this option to prevent the use of next hop proxies for local addresses.
Then click on Apply Changes to make this setting effective.
Local addresses have no dots (.) within their specifications.
So, after enabling this option, you can fine-tune Webwasher in an intranet
and enter the name of a local server in the browser, e. g. server_name,
instead of typing a URL, e. g. https://server_name.fooo.com.
Webwasher will then contact this local server directly without using the configured
proxy.
Using this option speeds up internal connections and reduces load on the
proxy server.
5–61

Proxies
5–62
• if URL matches
This input field is the first of severals items provided for specifying information
on the next hop proxies you want to configure.
Enter a matching term here. If an URL matches this term, it will use the
next hop proxies specified further below in the usage mode that is also
specified further below.
• use mode
From this drop-down list, select the mode to be used for the URLs and next
hop proxies specified here. The following modes are available:
— None
This mode uses no next hop proxies. Direct connections will be used
instead.
— specific
In this mode, one specific next hop is set for the URLs configured
above.
— failover
In this mode, the first next hop given in the participants list is tried first.
If it fails, it will be retried until the configured retry maximum for it has
been reached.
Then the second next hop proxy in the participants list is tried, etc.
— round robin
In this mode, the next hop proxy is used that is next in the participants
list to the one that was used last.
This means also that the participants is used in a circular manner: If
the end of the list has been reached, selection of next hop proxies will
restart from the beginning.
• participating next hops
In this input field, enter the next hop proxies that should be used for the
URLs specified here.
To do this, type a proxy name or select one from the drop-down list to the
right of this input field.
You can add more than one proxy by repeating this operation.
The drop-down lists shows select one to add as its topmost entry. If no
next hop proxies have been configured yet, the topmost entry reads no
Next Hops defined.

Proxies
To configure next hop proxies, click on the Define Next Hop Proxies
button, which is located further to the right.
This will open a window, where you can specify the information required to
configure a next hop proxy.
For the description of this window, see the Available Proxies subsection
further below.
• Add Entry to List
After specifying the appropriate information about a next hop proxy, click
on this button to add it to the list.
The list of next hop proxies is displayed at the bottom of this section. For each
entry, it provides the information that is specified when a new entry is added.
You can edit list entries, move them up and down in the list, or delete them.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key on your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input fields of the URL, use
mode and participating next hops columns. Then click on Apply Changes
to make this setting effective.
You can edit more than one entry and make the changes effective in one go.
The list also contains an entry with * as value for the URL parameter. It is
always in last position within the list and cannot be deleted. By editing this
entry, you can configure a next hop proxy setting for all URLs that are not
represented by a particular entry in the list.
Since the * entry is last in the list, it becomes effective only after all other list
entries were read by Webwasher and used for establishing next hop proxy
connections.
By default none is specified as mode for the * entry, which means that there
will be no next hop proxy connections for URLs that are not otherwise included
in the list.
5–63

Proxies
5–64
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field above the URL, use mode or
participating next hops or in a combination of them and enter this using
the Enter key of your keyboard.
The list will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there is
more than one entry in the list containing information on a particular URL
or next hop proxy, the entry that is first in the list wins.
Available Proxies
The section in this window allows you to configure next hop proxies for all kinds
of connections. These will then be available for selection on the Use Next Hop
Proxies tab.
After specifying the appropriate settings for a next hop proxy, it is added to the
list of available next proxies by clicking on the Add button.
The list is displayed at the bottom of the section. You can modify the settings
for each proxy that is shown in the list.
Use the following items for configuring available next hop proxies:
• Name
In this input field, enter the name of the next hop proxy you want to configure.
If you leave the field empty, a name will be generated by Webwasher, e. g.
pxy1, and inserted in this field after clicking on the Add button.

Proxies
The name can be modified after the new proxy has been included in the
list.
• Proxy server address
In the input fields provided here, enter the address of the server you want
to make available as next hop proxy:
— Host
Enter the IP address or URL of this server here.
— Port
Enter the port number of the port for connecting to this server here.
• Proxy authorization
In the input fields provided here, enter the credentials that Webwasher
should use for authentication at the next hop proxy:
— Username
Enter the IP address or URL of this server here.
— Password
Enter the password here.
• Connection behavior
Use the items provided here to configure the connection behavior:
— Retry . . . times on failure for this proxy
From the drop-down list provided here, select the number of retries you
want to configure for a next hop proxy. You can configure up to three
retries.
When the maximum number of retries has been reached, Webwasher
will try to establish a connection using another next hop proxy, according
to what has been configured on the Use Next Hop Proxies tab,
e. g. failover or round robin.
— Donotretryproxyfor...minuteswhenithasreached...
times within 10 seconds its maximum number of retries
In the input fields provided here, enter the time information that will
cause a connection break, i. e. an interval during which Webwasher
will not retry a next hop proxy after a connection to it could not be established
in a given situation.
In the first input field, enter the time (in minutes) that the connection
break should last.
5–65

Proxies
5–66
In the second input field, specify how often the maximum number of retries
must have been reached within 10 seconds before the connection
break is started.
— use persistent connections
• Add
If you want Webwasher to use persistent connections to the next hop
proxies, make sure this checkbox is marked. The checkbox is marked
by default.
Webwasher will try to meet this requirement by establishing persistent
connections, but may fail to do so in some situations.
You will then see that the failed counter in the list of available next
proxies displays an increased value for the connection to the next hop
proxy in question.
In this case, you might clear the checkbox to disable the option. Note,
however, that this will reduce performance.
After specifying the appropriate information for the server you want to make
available as next hop proxy, click on this button to add it to the list of available
next hop proxies.
The list of available next hop proxies is displayed at the bottom of this section.
For each entry, it provides the information that is specified when a new entry
is added.
Furthermore statistical figures are displayed on the reliability of next hop proxies.
You can edit list entries, delete them and reset the statistics.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, click on the View Details and Edit link in the same line. This
will reopen the window and this section with the information concerning the
next hop proxy in question, so you can modify it.
After completing the modification, click on the Modify button, which is provided
now instead of the Add button, to make it effective.
If you want to clear the information before modifying the settings for a next hop
proxy, click on the Clear Input button.

Proxies
Apart from the information that was specified when a new entry was added to
the list, such as the proxy name and address, the list displays statistical figures
on the reliability of each next hop proxy.
The following information is provided in the columns of the list:
• reliability
Reliability of a next hop proxy
The reliability is calculated as the percentage of attempts to establish a
connection to the next hop proxy that were successful in relation to the
overall number of attempts.
• tried
Number of times that Webwasher tried to establish a connection to a proxy
• failed
Number of times that an attempt by Webwasher to establish a connection
toaproxyfailed
• last fail
Date and time of the last time that an attempt by Webwasher to establish
a connection to a proxy failed
• do not retry reached
Date and time of the last time that a situation was reached where Webwasher
did not retry a next hop proxy over a given period of time.
The length of this period depends on what you configured under Do not
retry proxy for . . . minutes when it has reached . . . times
within 10 seconds its maximum number of retries, see above.
If the do not retry situation is still on, i. e. Webwasher will currently not retry
the next hop proxy in question, the date and time values are displayed in
red.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input fields above the Name, Proxy or Port
columns or in a combination of them and enter this using the Enter key of
your keyboard.
The list will then display only entries matching the filter.
5–67

Proxies
5–68
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Reset Statistics
Click on this button to reset the statistical figures shown in the list for reliability
of next hop proxies.
• Reset do not retry
Click on this button to reset the statistics only for the do not retry reached
parameter, see above.
To return to the Next Hop Proxies tab, click on the Close button.
The next hop proxy you added to the list, will also appear and be available in
the list of next hop proxies, which is displayed at the bottom of the Use Next
Hop Proxies section on that tab.

5.3.3
Authentication
The Authentication tab looks like this:
At the top of this tab, there is a button labeled:
• Define Proxy Authentication Options
Proxies
Click on this button to configure some additional options relating to all kinds
of proxies. This will open a window where you can specify the appropriate
information.
The options of this window are described in the Define Proxy Authentication
Options Window subsection of 5.2.3.
Furthermore, there are five sections on this tab:
• Authentication Process
• Authentication Options
• NTLM and NTLM-Agent Authentication Options
• User Database Authentication Options
• IP Forwarding
They are described in the following.
5–69

Proxies
5–70
For a sample procedure to configure the eDirectory authentication method, see
also 5.2.3.
Authentication Process
The Authentication Process section looks like this:
Using this section, you can configure the order authentications methods are
applied during the authentication process.
Specify the appropriate order and click on Apply Changes to make your settings
effective.
To specify this order, select the authentication method you want to be applied
first from the first of the two drop-down lists provided here.
From the second drop-down list, select the method you want to be applied
afterwards.
More information on the authentication process methods is provided in the Authentication
Process subsection of 5.2.3 , and also in the subsections below.
Authentication Options
The Authentication Options section looks like this:
Using this section, you can configure options with regard to whether authentication
is required or not and what to do in case the authentication server is
down.
Specify the appropriate information and click on Apply Changes to make your
settings effective.

Use the following items to configure these authentication options:
• Always authenticate client
Proxies
Enable this option if you want authentication to be required for any client
request.
Webwasher will then try to authenticate the client until it is successful or
until it finds that the authentication server is down.
In this latter case, the setting of the option described below will apply.
• Allow Internet access when authentication server is down
Enable this option if you want to allow a client request in case Webwasher
has found that the authentication server is down.
NTLM and NTLM-Agent Authentication Options
The NTLM and NTLM-Agent Authentication Options section looks like
this:
Using this section, you can configure the NTLM authentication method, which
retrieves information that is stored in the database of a Windows domain controller
in order to authenticate users.
This method can be used by browsers, proxies and servers. It offers more
security than other methods because the user password can be transmitted in
an encrypted format.
You can also use an agent application, the NTLM Agent, for enabling this authentication
method. The settings that are configured here will also apply to
this agent application.
There is a basic and an integrated way of applying this authentication method.
With basic authentication, the client browser sends the user name and password
in plain text (less secure). Integrated authentication encrypts messages
going from the client browser to the server and back.
5–71

Proxies
5–72
In the process of user authentication, Webwasher contacts the corresponding
domain controller and retrieves a list of global domain groups that this user is
a member of, or a list of local groups on the domain controller, or both.
You can also specify a default domain that is used to verify membership of a
user if no other information is available.
The ICAP server can retrieve information on user groups to perform policy
mapping. A list of these groups must be provided by the ICAP client.
Note that the user and user group information required for policy mapping
should not be stored in a subdirectory of the domain controller since it may
not be possible to retrieve it from there.
It should be stored, e. g., in \company.com rather than in \company.com\e-mail
aliases.
Note also that if you are using the NTLM Agent, a tool like NTLMTest.exe will
enable you to view a list of the groups the domain controller actually sends to
the NTLM Agent, which forwards it to Webwasher.
Ask your support team for this tool and install it on the system the NTML Agent
is running on.
After specifying the appropriate information here, click on Apply Changes to
make your settings effective.
Use the following items to configure the NTLM and NTLM-Agent authentication
methods:
• Enable integrated authentication
If you want to use the integrated authentication method, make sure this
checkbox is marked. The checkbox is marked by default.
• Enable basic authentication
If you want to use the basic authentication method, mark this checkbox.
• Default domain
In this input field, type the name of the domain that should be used as
default in the process of user authentication.
• Select what groups to get from Domain Controller
From the drop-down list provided here, select what groups should be retrieved
from the domain controller: Global, Local or both.

User Database Authentication Options
The User Database Authentication Options section looks like this:
Proxies
Using this section, you can configure authentication by means of using the
information stored in a user database.
There is a basic and an integrated method of authenticating users.
With basic authentication, the browser sends the user name and password
as plain text (less secure) to Webwasher (who plays the role of the client to
exchange authentication messages with the authentication server), so Webwasher
uses the information stored in the user database to authenticate the
user.
Integrated authentication encrypts messages going from the client browser to
the authentication server and back. In this situation, Webwasher acts as the
proxy server and forwards authentication server messages to the client.
After specifying the appropriate information, click on Apply Changes to make
this setting effective.
Use the following items to configure this kind of authentication:
• Enable integrated authentication
Enable this option to use the integrated authentication method. This is the
default option.
• Enable basic authentication
Enable this option to use the basic authentication method.
IP Forwarding
The IP Forwarding sectionlookslikethis:
5–73

Proxies
Using this section, you can configure which header is forwarded to the ICAP
server and also to the Web server or next hop proxy if required.
Specify the appropriate information and click on Apply Changes to make this
setting effective.
Use the following items to configure the forwarding of headers:
• IP from header ...
Make sure this option is enabled if you want to use it, and enter a header
in the input field provided here.
The IP address that is forwarded to the ICAP server is then taken from this
header.
The option is enabled by default. The default header is X-Forwarded-For.
• Client IP
5.3.4
ICAP Services
5–74
Enable this option if you want to the IP address of the client to be forwarded
to the ICAP server.
The ICAP Services tab looks like this:
There are two sections on this tab:
• Services
• List of Available ICAP Services
They are described in the following.

Services
The Services section looks like this:
Proxies
Using this section, you can configure the ICAP client services to be used for
REQMOD, CERTVERIFYand RESPMOD communication.
The following input fields are provided in this section:
• REQMOD services
Enter the ICAP client services to be used for REQMOD communication
here. If you enter more than one service, separate them by the | (pipe
sign).
You can also enter a service by selecting it from the drop-down list next to
this input field.
• CERTVERIFY services
Enter the ICAP client services to be used for CERTVERIFY communication
here. If you enter more than one service, separate them by the | (pipe sign).
You can also enter a service by selecting it from the drop-down list next to
this input field.
• RESPMOD services
Enter the ICAP client services to be used for RESPMOD communication
here. If you enter more than one service, separate them by the | (pipe sign).
You can also enter a service by selecting it from the drop-down list next to
this input field.
5–75

Proxies
5.4
FTP Proxy
5–76
List of Available ICAP Services
The List of Available ICAP Services section looks like this:
It displays a list of the services that are available for being configured in the
Services section above.
To add a service to the list, click on the ICAP Service Definition link that is
provided here.
This will open a window for adding services. For a description of this window,
see the ICAP Service Definition Window subsection of 5.2.4.
The FTP Proxy options are invoked by clicking on the corresponding button
under Proxies:
If you want to enable any of these options, you also need to mark the checkbox
that is on this button.
Then click on Apply Changes to make this setting effective.
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Settings, see 5.4.1
• Next Hop Proxies, see 5.4.2
• Authentication, see 5.4.3
• ICAP Services, see 5.4.4

5.4.1
Settings
The Settings tab looks like this:
There are two sections on this tab:
• Port Settings
• FTP Options
They are described in the following.
Proxies
5–77

Proxies
5–78
Port Settings
The Port Settings section looks like this:
This section displays a list of the ports that are opened by Webwasher as listener
ports for the ICAP client when Webwasher is configured as FTP proxy.
You can add entries to the list and edit or delete them. Furthermore, you can
configure the data port.
FTP uses a control connection (where all replies are sent) that is always initiated
by the client as in any classic TCP/IP client-server protocol.
But as soon as some file or directory content is downloaded, a second connection
(the data connection) is set up, where the data transfer occurs.
Use the following button to add a port to the list:
• Add Proxy Port
Click on this button to open a window where you can specify information
on a new listener port and enter it in the list.
For a description of this window, see the Port Settings subsection below.
The default port has the port number 2121. This port is entered by default in
the list and cannot be deleted. You may, however, change the port number.
The following information is provided in the list for each listener port:
• Address
IP address and port number of the listener port.
The specification of the IP address is optional and may therefore not be
displayed here.
• Allow access from
IP addresses of the sites that should have access to the listener port.

An * in this field means that every site is allowed access.
• Policy
Proxies
Policy that will be applied during communication with the ICAP client over
the listener port.
This is not part of the authentication process for a client, but of the policy
mapping that maps this client to a particular policy.
If no policy is selected here, there will be no particular policy for communication
with a client over this listener port. Instead, the policy that was
configured for the ICAP server will be used.
To edit an entry, type the appropriate text in the input fields of the Address and
Allow access from columns, and select a policy from the Policy drop-down
list in the same line as required.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Use the following item to delete entries that are in the list:
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, with the exception of the default listener port, mark the
Select all checkbox and click on this button.
Use the following item to configure the FTP data port:
• Data Port
Specify the data port here. The input format is as follows:
port
The default port number is 2020.
Note that for security reasons, Webwasher runs under plain user rights (as
opposed to root rights). Hence you can’t choose a privileged port (below
1024) at runtime.
If you choose a privileged port, you have to restart Webwasher to make it
available.
5–79

Proxies
5–80
Port Settings
The Port Settings window opens after clicking on the Add Proxy Port button.
It looks like this:
Using this window you can add a port to the list of listener ports that are opened
by Webwasher for communication with the ICAP client when Webwasher is
configured as FTP proxy.
Use the following items of this window to configure the port settings and add
the port the list:
• Port
In this input field, specify the port by entering an IP address and a port
number. The input format is:
[IP]: port
Note that for security reasons, Webwasher runs under plain user rights (as
opposed to root rights). Hence you can’t choose a privileged port (below
1024) at runtime.
If you choose a privileged port, you have to restart Webwasher to make it
available.
• Allow access from
In this input field, specify the IP addresses of the sites that should have
access to the listener port. The input format is:
(IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]*.
Entering an * in this field means to allow every site access.

• Use Policy
Proxies
From the drop-down list provided here, select a policy that will be applied
during communication with the ICAP client over the listener port.
This is not part of the authentication process for a client, but of the policy
mapping that maps this client to a particular policy.
If no policy is selected here, there will be no particular policy for communication
with a client over this listener port. Instead, the policy that was
configured for the ICAP server will be used.
On the other hand, if a policy is selected here, the policy that was configured
for the ICAP server will no longer be used.
• Add
After specifying the appropriate information about a listener port, click on
this button to add it to the list.
If the addition was successful, a corresponding message is displayed in
this window. You can then go on to add another port to the list.
• Close
Click on this button to close the window and return to the Settings tab.
FTP Options
The FTP Options section looks like this:
Using this section, you can configure the handling of FTP requests.
The following options are provided in this section:
• Allow clients to use passive FTP connections
If this option is enabled, Webwasher will allow the client to use the passive
connection mode for data connections between the client and Webwasher.
The option is enabled by default. Active connections are always allowed.
5–81

Proxies
5–82
FTP uses a control connection initiated by the client as in any classic
TCP/IP client-server protocol. But whenever some file or directory content
is downloaded, a second connection (the data connection) is set up.
The default is for FTP to have an active data connection, where the server
initiates the data connection to the client.
This may, however, cause problems for a firewall policies, which usually do
not allow external connections into the corporate network.
A passive data connection is initiated by the client over the port the client
received in response to its PASV command. The passive mode is optional,
as not all clients and servers support it.
Since Webwasher is a proxy itself, it connects to both the client and the
server.
• Webwasher uses passive FTP connections
If this option is enabled, Webwasher will issue the PASV command in order
to initiate a passive data connection to the FTP server. If the FTP server
does not support this, no data connection will be possible.
The option is enabled by default. It may be used in case a firewall policy
does not allow active connections.
• Anonymous password
This option can be used in case FTP over HTTP is enabled and Webwasher
has been configured as proxy server.
No user data is then transmitted unless the username and password are
not already provided in the URL.
In the input field provided here, enter a password, which is the e-mail address.
This will enable you to continue as usual, by logging on to a remote FTP
server as anonymous and submitting your password.

5.4.2
Next Hop Proxies
The Next Hop Proxies tab looks like this:
There is one section on this tab:
• Use Next Hop Proxies
It is described in the following.
Proxies
5–83

Proxies
5–84
Use Next Hop Proxies
The Use Next Hop Proxies section looks like this:
Using this section, you can configure next hop proxies for FTP connections.
You can specify the URLs that next hop proxies should be used for, as well as
the mode of this usage and the next hop proxies to be used.
The Use Next Hop Proxies feature is not enabled by default. To enable it,
mark the checkbox next to the section heading. Then click on Apply Changes
to make this setting effective.
Furthermore, use the following items to configure next hop proxies:
• Do not use Next Hops for local addresses
Enable this option to prevent the use of next hop proxies for local addresses.
Then click on Apply Changes to make this setting effective.
Local addresses have no dots (.) within their specifications.
So, after enabling this option, you can fine-tune Webwasher in an intranet
and enter the name of a local server in the browser, e. g. server_name,
instead of typing a URL, e. g. ftp://server_name.fooo.com.
Webwasher will then contact this local server directly without using the configured
proxy.
Using this option speeds up internal connections and reduces load on the
proxy server.

• if URL matches
Proxies
This input field is the first of severals items provided for specifying information
on the next hop proxies you want to configure.
Enter a matching term here. If an URL matches this term, it will use the
next hop proxies specified further below in the usage mode that is also
specified further below.
• use mode
From this drop-down list, select the mode to be used for the URLs and next
hop proxies specified here. The following modes are available:
— None
This mode uses no next hop proxies. Direct connections will be used
instead.
— specific
In this mode, one specific next hop is set for the URLs configured
above.
— failover
In this mode, the first next hop given in the participants list is tried first.
If it fails, it will be retried until the configured retry maximum for it has
been reached.
Then the second next hop proxy in the participants list is tried, etc.
— round robin
In this mode, the next hop proxy is used that is next in the participants
list to the one that was used last.
This means also that the participants is used in a circular manner: If
the end of the list has been reached, selection of next hop proxies will
restart from the beginning.
• participating next hops
In this input field, enter the next hop proxies that should be used for the
URLs specified here.
To do this, type a proxy name or select one from the drop-down list to the
right of this input field. You can add more than one proxy by repeating this
operation.
The drop-down lists shows select one to add as its topmost entry. If no
next hop proxies have been configured yet, the topmost entry reads no
Next Hops defined.
5–85

Proxies
5–86
To configure next hop proxies, click on the Define Next Hop Proxies
button, which is located further to the right.
This will open a window, where you can specify the information required to
configure a next hop proxy.
For the description of this window, see the Available Proxies subsection
further below.
• Add Entry to List
After specifying the appropriate information about a next hop proxy, click
on this button to add it to the list.
The list of next hop proxies is displayed at the bottom of this section. For each
entry, it provides the information that is specified when a new entry is added.
You can edit list entries, move them up and down in the list, or delete them.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key on your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input fields of the URL, use
mode and participating next hops columns. Then click on Apply Changes
to make this setting effective.
You can edit more than one entry and make the changes effective in one go.
The list also contains an entry with * as value for the URL parameter. It is
always in last position within the list and cannot be deleted.
By editing this entry, you can configure a next hop proxy setting for all URLs
that are not represented by a particular entry in the list.
Since the * entry is last in the list, it becomes effective only after all other list
entries were read by Webwasher and used for establishing next hop proxy
connections.
By default none is specified as mode for the * entry, which means that there
will be no next hop proxy connections for URLs that are not otherwise included
in the list.

Use the following items to perform other activities relating to the list:
• Filter
Proxies
Type a filter expression in the input field above the URL, use mode or
participating next hops or in a combination of them and enter this using
the Enter key of your keyboard.
The list will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there is
more than one entry in the list containing information on a particular URL
or next hop proxy, the entry that is first in the list wins.
Available Proxies
The section in this window allows you to configure next hop proxies for all kinds
of connections. These will then be available for selection on the Use Next Hop
Proxies tab.
After specifying the appropriate settings for a next hop proxy, it is added to the
list of available next proxies by clicking on the Add button.
The list is displayed at the bottom of the section. You can modify the settings
for each proxy that is shown in the list.
Use the following items for configuring available next hop proxies:
• Name
In this input field, enter the name of the next hop proxy you want to configure.
If you leave the field empty, a name will be generated by Webwasher,
e. g. pxy1, and inserted in this field after clicking on the Add button.
The name can be modified after the new proxy has been included in the
list.
5–87

Proxies
5–88
• Proxy server address
In the input fields provided here, enter the address of the server you want
to make available as next hop proxy:
— Host
Enter the IP address or URL of this server here.
— Port
Enter the port number of the port for connecting to this server here.
• Proxy authorization
In the input fields provided here, enter the credentials that Webwasher
should use for authentication at the next hop proxy:
— Username
Enter the IP address or URL of this server here.
— Password
Enter the password here.
• Connection behavior
Use the items provided here to configure the connection behavior:
— Retry . . . times on failure for this proxy
From the drop-down list provided here, select the number of retries you
want to configure for a next hop proxy. You can configure up to three
retries.
When the maximum number of retries has been reached, Webwasher
will try to establish a connection using another next hop proxy, according
to what has been configured on the Use Next Hop Proxies tab,
e. g. failover or round robin.
— Donotretryproxyfor...minuteswhenithasreached...
times within 10 seconds its maximum number of retries
In the input fields provided here, enter the time information that will
cause a connection break, i. e. an interval during which Webwasher
will not retry a next hop proxy after a connection to it could not be established
in a given situation.
In the first input field, enter the time (in minutes) that the connection
break should last.
In the second input field, specify how often the maximum number of retries
must have been reached within 10 seconds before the connection
break is started.

— use persistent connections
• Add
Proxies
If you want Webwasher to use persistent connections to the next hop
proxies, make sure this checkbox is marked. The checkbox is marked
by default.
Webwasher will try to meet this requirement by establishing persistent
connections, but may fail to do so in some situations.
You will then see that the failed counter in the list of available next
proxies displays an increased value for the connection to the next hop
proxy in question.
In this case, you might clear the checkbox to disable the option. Note,
however, that this will reduce performance.
After specifying the appropriate information for the server you want to make
available as next hop proxy, click on this button to add it to the list of available
next hop proxies.
The list of available next hop proxies is displayed at the bottom of this section.
For each entry, it provides the information that is specified when a new entry
is added.
Furthermore statistical figures are displayed on the reliability of next hop proxies.
You can edit list entries, delete them and reset the statistics.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, click on the View Details and Edit link in the same line.
This will reopen the window and this section with the information concerning
the next hop proxy in question, so you can modify it.
After completing the modification, click on the Modify button, which is provided
now instead of the Add button, to make it effective.
If you want to clear the information before modifying the settings for a next hop
proxy, click on the Clear Input button.
5–89

Proxies
5–90
Apart from the information that was specified when a new entry was added to
the list, such as the proxy name and address, the list displays statistical figures
on the reliability of each next hop proxy.
The following information is provided in the columns of the list:
• reliability
Reliability of a next hop proxy
The reliability is calculated as the percentage of attempts to establish a
connection to the next hop proxy that were successful in relation to the
overall number of attempts.
• tried
Number of times that Webwasher tried to establish a connection to a proxy
• failed
Number of times that an attempt by Webwasher to establish a connection
toaproxyfailed
• last fail
Date and time of the last time that an attempt by Webwasher to establish
a connection to a proxy failed
• do not retry reached
Date and time of the last time that a situation was reached where Webwasher
did not retry a next hop proxy over a given period of time.
The length of this period depends on what you configured under Do not
retry proxy for . . . minutes when it has reached . . . times
within 10 seconds its maximum number of retries, see above.
If the do not retry situation is still on, i. e. Webwasher will currently not retry
the next hop proxy in question, the date and time values are displayed in
red.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input fields above the Name, Proxy or Port
columns or in a combination of them and enter this using the Enter key of
your keyboard.
The list will then display only entries matching the filter.

• Delete Selected
Proxies
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Reset Statistics
Click on this button to reset the statistical figures shown in the list for reliability
of next hop proxies.
• Reset do not retry
Click on this button to reset the statistics only for the do not retry reached
parameter, see above.
To return to the Next Hop Proxies tab, click on the Close button.
The next hop proxy you added to the list, will also appear and be available in
the list of next hop proxies, which is displayed at the bottom of the Use Next
Hop Proxies section on that tab.
5.4.3
Authentication
The Authentication tab looks like this:
5–91

Proxies
5–92
At the top of this tab, there is button labeled:
• Define Proxy Authentication Options
Click on this button to configure some additional options relating to all kinds
of proxies. This will open a window where you can specify the appropriate
information.
The options of this window are described in the Define Proxy Authentication
Options Window subsection of 5.2.3.
Furthermore, there are three sections on this tab:
• Authentication Process
• Authentication Options
• NTLM and NTLM-Agent Authentication Options
They are described in the following.
For a sample procedure to configure the eDirectory authentication method, see
also 5.2.3.
Authentication Process
The Authentication Process section looks like this:
Using this section, you can configure the order authentications methods are
applied during the authentication process.
Specify the appropriate order and click on Apply Changes to make your settings
effective.
To specify this order, select the authentication method you want to be applied
first from the first of the two drop-down lists provided here.
From the second drop-down list, select the method you want to be applied
afterwards.
More information on the authentication process methods is provided in the Authentication
Process subsection of 5.2.3 , and also in the subsections below.

Authentication Options
The Authentication Options section looks like this:
Proxies
Using this section, you can configure what to do in case the authentication
server is down.
The following item is provided here for this purpose:
• Allow Internet access when authentication server is down
Enable this option if you want to allow a client request in case Webwasher
has found that the authentication server is down.
Then click on Apply Changes to make this setting effective.
NTLM and NTLM-Agent Authentication Options
The NTLM and NTLM-Agent Authentication Options section looks like
this:
Using this section, you can configure options for an authentication method that
performs an NTLM lookup in order to authenticate users.
NTLM is an authentication method used by browsers, proxies and servers. It is
more secure than other methods because the user password is not transmitted
as plain text.
The user of the NT domain is a member of several domain groups. The ICAP
server can use these groups to do the policy mapping. A list of groups must
be provided by the ICAP client.
If you want to do NTLM authentication and the operating system Webwasher
is running on is not Windows, you can use an agent application, the NTLM
Agent, to enable this.
The settings configured here will apply also for the agent application. For this
application, see also the settings in the NTML Agent Setup field.
There is a basic and an integrated method of authenticating users.
5–93

Proxies
5–94
With basic authentication, the browser sends the user name and password
as plain text (less secure) to Webwasher, who plays the role of the client to
exchange authentication messages with the authentication server, so Webwasher
uses the NTLM method to authenticate the user.
With the FTP protocol, only this authentication method can be configured.
Integrated authentication encrypts messages going from the client browser to
the authentication server and back. In this situation, Webwasher acts as the
proxy server and forwards authentication server messages to the client.
This can be useful if Webwasher does user authentication, applies policies and
forwards requests to the caching proxy.
After authenticating the user, Webwasher contacts the corresponding Domain
Controller and can retrieve either a list of global (domain) groups that the user
is a member of, a list of local groups on the domain controller, or both.
NTLM authentication can be configured as part of a policy mapping based on
user and user group information. Information about user groups is stored in a
directory on the domain controller.
It is important that this information should not be stored in a subdirectory since
it may not be possible to retrieve it from there.
So, it should be stored, e. g., in \COMPANY.com rather than in \COM-
PANY.com\E-Mail Aliases.
Note that if you are using the NTLM Agent, a tool like NTLMTest.exe will
enable you to view a list of the groups the domain controller actually sends to
the NTLM Agent, which forwards it to Webwasher.
Ask your support team for this tool and install it on the system the NTML Agent
is running on.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following items to configure NTLM and NTLM-Agent authentication:
• Enable basic authentication
Enable this option to use the basic authentication method and enter the
default domain used for basic authentication in the input field provided here.
• Select what groups to get from Domain Controller
From the drop-down list provided here, select what groups are to be fetched
from the domain controller: Global, Local or both.

5.4.4
ICAP Services
The ICAP Services tab looks like this:
There are three sections on this tab:
• Services
• List of Available Services
• Bypass ICAP Server
They are described in the following.
Services
The Services section looks like this:
Proxies
Using this section, you can configure the ICAP client services to be used for
REQMOD and RESPMOD communication.
5–95

Proxies
5–96
The following input fields are provided in this section:
• REQMOD services
Enter the ICAP client services to be used for REQMOD communication
here. If you enter more than one service, separate them by the | (pipe
sign).
You can also enter a service by selecting it from the drop-down list next to
this input field.
• RESPMOD services
Enter the ICAP client services to be used for RESPMOD communication
here. If you enter more than one service, separate them by the | (pipe sign).
You can also enter a service by selecting it from the drop-down list next to
this input field.
List of Available ICAP Services
The List of Available ICAP Services section looks like this:
It displays a list of the services that are available for being configured in the
Services section above.
To add a service to the list, click on the ICAP Service Definition link that is
provided here.
This will open a window for adding services. For a description of this window,
see the ICAP Service Definition Window subsection of 5.2.4.

Bypass ICAP Server
The Bypass ICAP Server section looks like this:
Proxies
Using this section, you can configure a bypassing of the ICAP Server for requests
made to particular hosts. These hosts are entered in a bypass list.
To add a host to the list, use the input field provided here. Enter the IP address,
host name or URL, omitting ftp://.
Then click on the Add button.
The bypass list is displayed at the bottom of this section.
To display only a particular number of list entries at a time, type this number in
the input field labeled Number of entries per page and enter it using the Enter
key of you keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input field of the corresponding
line.
Then click on Apply Changes to make the modification effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field above the list and enter it using
the Enter key of your keyboard.
The list will then display only entries matching the filter.
5–97

Proxies
5.5
• Delete Selected
E-Mail Gateway
5–98
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
The E-Mail Gateway options are invoked by clicking on the corresponding
button under Proxies:
If you want to enable any of these options, make sure the checkbox on this
button is also marked. The checkbox is marked by default.
After modifying the setting of this checkbox, click on Apply Changes to make
the modification effective.
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Gateway Settings, see 5.5.1
• ICAP Services, see 5.5.2
• Notifications, see 5.5.3
• ESMTP Extensions, see 5.5.4

5.5.1
Gateway Settings
The Gateway Settings tablookslikethis:
There are six sections on this tab:
• Port Settings
• SMTP Welcome Message
• HELO Name
• Relaxed Domain Name
• Address to Policy Mapping Options
• Release using Policy
They are described in the following.
Proxies
5–99

Proxies
5–100
Port Settings
The Port Settings section looks like this:
It allows you to configure the listening port for the e-mail server.
After specifying the appropriate information, click on Apply Changes to make
this setting effective.
Use the following input field to configure the listening port:
• Port
Enter the port number of the listener port here. The default port number is
25. It is highly recommended not to change it, since many mail clients do
not allow it to be configured.
You may also enter the IP address of the e-mail server.
The input format is:
[IP:]Port
SMTP Welcome Message
The SMTP Welcome Message section looks like this:
It allows you to configure a welcome message that will be sent to every connected
e-mail client in order to identify the server.
After specifying the appropriate information, click on Apply Changes to make
this setting effective.
Use the following input field to configure a welcome message.
• Message
Enter a text string for the welcome message here. The default message is
WW SMTP server ready.

HELO Name
The HELO Name section looks like this:
Proxies
It allows you to configure the name that is used in the HELO request Webwasher
sends to the mail server to identify itself when delivering e-mails.
After sending a HELO request to this server, Webwasher waits for the server
response.
After specifying the appropriate information, click on Apply Changes to make
this setting effective.
Use the following input field to configure the HELO name:
• Name
Enter the HELO name here. A fully qualified domain name is required as
input in this field.
The field is left blank by default. With no input here, Webwasher will use
the name of the system it is currently running on.
Relaxed Domain Name
The Relaxed Domain Name section looks like this:
It allows you to configure the special characters that should be allowed in a
domain name, e. g. the _ (underscore).
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following input field to do configure special characters in a domain
name:
• Characters
Enter the special characters you want to allow for domain names here.
5–101

Proxies
5–102
Address to Policy Mapping Options
The section labeled Address to Policy Mapping Options looks like this:
It allows you to configure actions that are to performed when a request to map
an e-mail to particular policy fails.
A PROFILE request, which is a non-standard ICAP method, is made to map
the sender or recipient of an e-mail to a particular policy. This request may fail
because the ICAP server is down or was replaced by another server.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following radio buttons to configure an action:
• Use default policy
If this radio button is checked, the default policy is used for the e-mail in
question regardless of its recipient.
The radio button is checked by default.
• Don’t filter e-mail
If this radio button is checked, the e-mail is not filtered.
• Repeat address mapping request later
If this radio button is checked, the request to map the e-mail to the policy
that was configured for it will be repeated at the next attempt to filter e-mails.

Release Using Policy
The Release Using Policy section looks like this:
Proxies
It allows you to configure the policy that should be applied to an e-mail upon
being released.
After specifying this setting, click on Apply Changes to make it effective
Use the following drop-down list to configure a release policy:
• Policy
Select a policy from this list. After being released, an e-mail will then be
moved to the inbound queue and processed according to this policy. Selecting
None means an e-mail is moved directly to the outbound queue
after being released.
By default, AVonly is selected here as a policy, which will ensure all e-mails
are virus-checked before being released.
5–103

Proxies
5.5.2
ICAP Services
5–104
The ICAP Services tab looks like this:
There are two sections on this tab:
• ICAP Services
• List of Available ICAP Services
They are described in the following.
ICAP Services
The ICAP Services section looks like this:
Using this section, you can configure the ICAP client services that should be
used in PROFILES and RESPMOD communication.
The e-mail gateway uses ICAP requests tin RESPMOD mode to filter e-mail
messages. PROFILES is a non-standard ICAP method for selecting user policies
that are applied to e-mail messages.

Proxies
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following input fields to configure ICAP client services:
• PROFILES services
Enter the ICAP client services to be used for PROFILES communication
here. You can enter more than one service. The default service is internal.
The input format is:
service1[ | service2]
• REQMOD services
Enter the ICAP client services to be used for RESPMOD communication
here. You can enter more than one service. The default service is internal.
The input format is:
service1[ | service2]
List of Available ICAP Services
The List of Available ICAP Services section looks like this:
It displays a list of the services that are available for being configured in the
Services section above.
To have a service from this list included in the group of services that are actually
used for e-mail communication, click on one of these buttons in the corresponding
line:
• Add to Profiles
ClickonthisbuttontomoveaservicetotheProfiles services group.
• Add to Respmod
Clickonthisbuttontomoveaservicetothe Respmod services group.
5–105

Proxies
5.5.3
Notifications
5–106
To add a service to this list, click on the ICAP Service Definition link that is
provided here.
This will open a window for adding services. For a description of this window,
see the subsection of 5.2.4.
The Notifications tab looks like this:
There is one section on this tab:
• System Notifications
It is described in the following. Furthermore, a description is given of the window
that opens after clicking on the Edit Notification Mail Server button in
this section:
• Notification Settings Window

System Notifications
The System Notifications section looks like this:
Proxies
Using this section, you can configure e-mail notifications relating to special
events, which are sent to the e-mail address of a recipient.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following items to configure e-mail notifications:
• Send notification if a problem with SMTP Gateway detected
To send a notification in this situation, mark the checkbox provided here
and enter the recipient of the notification in the Recipient input field.
• Send notification if a non processable mail detected
To send a notification in this situation, mark the checkbox provided here.
The recipient is the same as specified above.
• Send notification if SMTP Gateway stopped due to high recovery
rate
To send a notification in this situation, mark the checkbox provided here.
The recipient is the same as specified above.
• Send notification if mail is being processed more than ... minutes
To send a notification in this situation, mark the checkbox provided here.
In the input field, enter the number of minutes that must elapse before a
notification is sent. The default number is 10.
The recipient is the same as specified above.
5–107

Proxies
5–108
• Edit Notification Mail Server
To configure the settings for the server used to process notifications, click
on this button.
This will open a window where you can enter the appropriate values. It is
described in the subsection below.
• Send Test Messages
After configuring notifications, click on this button to send test messages.
Notification Settings Window
After clicking on the button labeled Edit Notification Mail Server in the System
Notifications section, the Notification Settings window opens:
In this window, you can specify the settings of the mail server that is used to
send the notifications you configured on the Notifications tab.
After configuring these settings, click on OK to make them effective. Click on
Cancel to close the window without configuring any server settings.
Use the following input fields to configure the server settings:
• SMTP server address
Enter the IP address of the server here.
• SMTP server port
Enter the port number here of the port that is used on the server for sending
the notifications.
The default port number is 25.

• HELO name
Proxies
Enter the name here that Webwasher should send in a HELO request to
the notification mail server in order to identify itself.
• Sender
Enter the sender address of the e-mails here that are sent as notifications.
The default address is Webwasher@localhost.
5.5.4
ESMTP Extensions
The ESMTP Extensions tab looks like this:
5–109

Proxies
5–110
There is one section on this tab:
• ESMTP Extensions
It is described in the following.
ESMTP Extensions
The ESMTP Extensions section looks like this:
Using this section, you can configure ESMTP extensions. After configuring an
extension, the communication between the client and the Webwasher server
will be conducted in Enhanced SMTP (ESMTP) mode.
If an extension has been configured, this is announced to the client in the welcome
message it receives from the Webwasher server.
After specifying the appropriate settings, click on Apply Changes to make
them effective.

The meaning and usage of the ESMTP extensions is as follows:
• SIZE Extension
Proxies
There is a size limit for sending messages to the Webwasher server. In the
welcome message, the client is notified of this.
• 8BIT MIME Extension
The Webwasher server accepts messages with Body Type = 8 bit. In
the welcome message, the client is notified of this.
Note: The target server may, however, not accept messages with this
body type. In this case, the Webwasher server is unable to deliver the
client message.
• DSN Extension
The Webwasher server may generate a Delivery Status Notification (DSN)
after forwarding a message from the client. In the welcome message, the
client is notified of this.
The notification mode must be specified by the client. The client can specify
any the following options (combinations of the last three options are
permitted):
never - No notifications will be sent to the client.
relayed - The client is notified after a message has been forwarded to the
target server.
delayed - The client is notified if a message has been forwarded to the
target server, but is delayed, i. e. it is unknown so far whether the target
server received this message.
failed - The client is notified if the delivery of a message to the target server
has failed.
Another option is provided for notifications to the postmaster:
— Send a copy to postmaster
Enable this option if you want a copy of every notification to be sent to
the postmaster.
To specify the postmaster’s address, i. e. the address the notifications
are sent to, invoke the Notifications tab.
In the System Notifications section, enter the address in the Recipient
input field provided together with the option labeled Send notification
if a problem with SMTP Gateway detected.
5–111

Proxies
5–112
— Add original subject to the generated notification
Enable this option if you want the subject of the e-mail in question to
be included in the notification to the postmaster.
• STARTTLS Extension
The TLS (Transport-Layer Security) method will be used for communication
between the Webwasher server and the client. This is a method enabling
private, authenticated communication within the Internet.
Whenever a client wants to establish an SSL-secured connection, Webwasher
sends a server certificate to identify itself. You can either have
Webwasher issue the certificate or import an externally issued certificate.
You can also enforce the use of this extension for particular servers. To
specify them, the following input field is provided:
— Enforce TLS for ...
Enter the server or servers here that you want to enforce the use of
TLS for. The input format is:
IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]* )
If you specify an *, all servers will be forced to use TLS.
To configure the certificate Webwasher sends to the client for authentication,
use the input fields and buttons of the following area:
— Certificate Options
The following options are provided here:
Use Webwasher generated certificate with CN ...
This is the default option. Webwasher will issue the certificate and
sign it with its own CA. In the input field provided here, enter the
name of the certificate file.
This will work well as long as only well-known clients will connect
that have the Webwasher Root CA installed. The private key handling
is done as has been configured for the SSL Scanner and
HTTPS Web interface and digest. To change these settings, go
to Configuration > Certificate Management > Private Key
Handling.
Externally issued certificate
This option enables you to use a certificate issued by an external
CA.

5.6
Delivery Options
Proxies
Use the Browse button next to the input field labeled Import certificate
to browse for this certificate, and click on the Importbutton
to import it.
To view the certificate, click on the certificate link provided here.
There are two options of configuring the decrypting of the handshake
for an imported certificate:
by this Webwasher instance
With this option, the handshake will be done by the Webwasher
instance that a client connects to. Use the Browse button next
to the input field labeled Import private key to browse to a
private key for the handshake.
Furthermore, you need to provide a passphrase in the
Passphrase input field. Then click on the Import button to
import the private key.
by remote service using HSM Agent with key
With this option, the handshake will be done by a remote service,
which is handled by the Webwasher HSM Agent. Enter a
key ID in the input field provided here to specify the key that is
required for the remote service to perform the handshake.
You also need to configure the HSM Agent connection in order
to be able to use this option. To do this, go to Configuration
> Certificate Management > Private Key Handling.
The Delivery Options are invoked by clicking on the corresponding button
under Proxies:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Delivery Options, see 5.6.1
• Routing Rules, see 5.6.2
• Secure Mail Delivery List, see 5.6.3
5–113

Proxies
5.6.1
Delivery Options
5–114
The Delivery Options tab looks like this:
There are two sections on this tab:
• E-Mail Delivery Options
• Secure E-Mail Delivery
They are described in the following.
E-Mail Delivery Options
The E-Mail Delivery Options section looks like this:
Using this section, you can configure how Webwasher should deliver scanned
e-mails. This can be done using DNS and routing rules or using an another
gateway.

Proxies
The routing rules are configured on the Routing Rules tab under Delivery
Options.
After specifying the appropriate settings here, click on Apply Changes to
make them effective.
Use the following items to configure e-mail delivery:
• Use DNS and routing rules
Check this radio button to configure the use of DNS and routing rules.
• Use another gateway for e-mail delivery
Check this radio button to configure the use of another gateway. Specify
this gateway by entering the appropriate information in the following input
fields:
— Gateway address
Enter the IP address or URL of the gateway you want to use in this
input field. You can specify more than one gateway here.
The input format is as follows:
IP or URL [:port] [, IP or URL [:port], ...]
— Port of that gateway
In this input field, enter the port number for this gateway. The default
port number is 25.
— Number of retries on gateway overload
From the drop-down list provided here, select a number to configure
how many times Webwasher should retry to deliver an e-mail when the
first attempt failed due to a gateway overload.
Secure E-Mail Delivery
The Secure E-Mail Delivery section looks like this:
5–115

Proxies
5–116
It allows you to configure if Webwasher should use encrypted connections to
deliver e-mails.
For the encryption, the TLS (Transport Layer Security) feature is used. You
can have Webwasher look up in a list whether TLS encryption is to be used for
connections to destination servers or intermediate gateways, or let it depend
on the ability of a remote system to use TLS encryption.
Note that Webwasher will not check the server certificate for a connection,
which means that the connection is encrypted, but not authenticated.
Enable the options provided here according to your requirements and click on
Apply Changes to make effective what you configured. The meaning of these
options is as follows:
• Use secure mail delivery list
Webwasher will look up in this list whether a connection to an individual
server or a domain or to a gateway must be TLS encrypted or not. If there
is more than one entry in the list relating to a particular system, the first
match wins.
If TLS encryption must be used, but the remote mail server does not support
it, the e-mail in question will stay in the outbound queue. You can configure
Webwasher to send a notification to the administrator in this case.
Enable the following option to do this:
— Send notification if TLS is required, but not supported by remote
mail server
A notification will be sent to the address you enter in the Recipient
input field.
Note that to be able to send notifications you need to configure the notification
mail server. Clicking on the button labeled Edit Notification
Mail server will open window where you can do this.
For a description of this window, see the Notification Settings Window
subsection of 5.5.3.
To test the settings you have configured, click on the Send Test Message
button.
• Use TLS if it is supported by remote mail server
Webwasher will use TLS encrypted connections if this is supported by the
remote mail server, but this will only be done if the server was not found in
the secure delivery list or the lookup for this list is deactivated.

5.6.2
Routing Rules
The Routing Rules tab looks like this:
There are four sections on this tab:
• LDAP Lookup
• List Options
• Add Rule
• Current Rules
They are described in the following.
Proxies
5–117

Proxies
5–118
LDAP Lookup
The LDAP Lookup section looks like this:
It allows you to perform an LDAP lookup before an e-mail is delivered to a
recipient.
The LDAP server will then be searched for entries concerning particular attributes
of this recipient.
To perform the lookup, mark the checkbox next to the section heading and
specify the attributes you want to be searched for. You can specify the following
attributes:
• Recipient attribute
Attribute of an individual user listed on the LDAP server.
This is a user within your network who is allowed to receive e-mails.
• Group attribute
Attribute of a user group listed on the LDAP server.
The users of this group are within your network and are allowedtoreceive
e-mails.
• Mail group attribute
Attribute of a mail group listed on the LDAP server.
The users of this group are within your network and are allowed to receive
e-mails.
To specify an attribute, check the attribute type and enter the attribute name in
the corresponding input field.

Proxies
You can apply additional rules to the result of this query, using the following
option:
• Apply static rules to the result of LDAP query
Mark this checkbox to apply rules that are configured using the Add Rule
section, which is located also on this tab. If any rules have been set up so
far, they are listed in the Current Rules section below Add Rule
These rules map mail servers to domains. An e-mail that is sent to a recipient
within a particular domain is then routed to the mail server that has
been configured for it. By applying these rules to the result of the LDAP
query, you can improve the routing process.
So, e. g. the following rules may have been set up:
mail_server_for_germany = germany
mail_server_for_usa = usa
An LDAP lookup where user location was specified as recipient attribute
might yield the value Germany as the result for a particular e-mail. Application
of the rules would then route this e-mail to the mail_server_
for_germany mail server.
Check this option if you want apply these rules. Then click on Apply Changes
to make your settings effective.
You can also specify a list of domains for the LDAP lookup. The attribute search
will then be restricted to these domains. Click on the word here at the bottom
of the section to go to the Recipient LDAP Check tab, which is used for specifying
the domains.
This tab is located under Proxies > Relay Protection. It also provides a link
that takes you to a tab for configuring more LDAP server settings.
List Options
The List Options section looks like this:
Using this section, you can configure some additional options for specifying
domain names.
5–119

Proxies
5–120
You can enable shell expressions in these names and specify the separator
that is used when more than one domain name is listed.
Use the following checkbox and input field to configure these options:
• Enable shell expressions in domain names
Mark this checkbox to enable shell expressions in domain names.
• Values separation string
In this input field, enter the character you want to use for separating domain
names.
By default, the , (comma) is used for this purpose, but you may want to
configure a different separator, e. g. in order to allow commas within domain
names.
Add Rule
The Add Rule section looks like this:
Using this section, you can configure rules for mapping mail servers to domains.
If you would like, e. g., to have all e-mails that are addressed to
somedomain.net sent to your corporate mail server, enter a rule like
mailserver=somedomain.net.
If Webwasher processes incoming mails addressed to yourcompany.com,
you may create a rule to send these mails directly to the mail server, or Webwasher
may ask the DNS server, resolve yourcompany.com toalistofmail
servers, and send it to itself.
Another solution may be to have a local DNS server, with a local MX entry for
your domain.
On a method to configure a routing for e-mails that overrules the existing routing
rules, see the Adding the X-WW-Route Header subsection below.
Use the input field provided here to add a rule to the rules list. The input format
is:
IP or URL [:port] [, IP or URL [:port], ...] = domain

Proxies
After entering a rule, click on the Add First or Add Last button, to add it at the
corresponding position of the list.
Note that the position an entry takes in this list is important since whenever
there is more than one entry containing information on a particular mail server
or domain, the entry that is first in the list wins.
You can, however, change the position of an entry after adding it, by editing
the list in the Current Rules List section below this section. Note that it is
only displayed if at least one rule has been configured.
Adding the X-WW-Route Header
In some situations, you may want to overrule the settings that have been configured
for routing e-mails, and route an e-mail to a particular mail server.
This can be done by creating a customized action that adds a header to the
e-mail in order to send it to that server.
Another way to achieve this would be to configure the Generic Header Filter
accordingly.
The name of the additional header that overrules existing routing rules is
X-WW-Route. To have this header added to an e-mail as part of a customized
action, go to Configuration > Action Editor. Create a new action,
and from the parameter list provided on the Action Definition tab select
Custom Headers.
Add this parameter to the action, and configure it further by entering X-WW-
Route in the Name input field on the Action Parameter tab. In the Value
input field enter the domain name, the IP address, or the fully qualified name
of the server that the e-mails should be sent to.
If you want to use the Generic Header Filter for configuring the addition of
the X-WW-Route Header, go to the corresponding tab under Common >
Generic Header Filter and enter the following values in the input fields provided
there:
Condition Header: X-WW-To
Condition Value:
Result Header: X-WW-Route
Result Value:
Furthermore, make sure that None is selected under Action on Match and
that the SMTP and Mail checkboxes are both marked.
5–121

Proxies
5–122
Current Rules
The Current Rules section looks like this:
It displays a list of the rules that are currently configured for domain routing.
You can edit entries in the list, move them up and down and also delete them.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input fields of the Rule column.
Then click on Apply Changes to make this setting effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform various activities relating to the list:
• Filter
Type a filter expression in the input field of the Rule column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.

Proxies
The position an entry takes in the list is important since whenever there is
more than one entry in the list containing information on a particular mail
server or domain, the entry that is first in the list wins.
5.6.3
Secure Mail Delivery List
The Secure Mail Delivery List tab looks like this:
There is one section on this tab:
• Secure Mail Delivery List
It is described in the following.
5–123

Proxies
5–124
Secure Mail Delivery List
The Secure Mail Delivery List sectionlookslikethis:
It provides a list of mail servers, server domains and gateways that Webwasher
can relay e-mails to. The list also shows whether a TLS encrypted connection
must be used or not when relaying e-mails to one of the systems entered here.
You can add entries to the list, and also edit them, move them up and down or
delete them.
To add an entry to the list, use the area labeled:
• Add new entry to the list
Specify the information concerning the system you want to enter in the list
using the following items:
— Domain
In this input field, enter a domain or host name or an IP address to
specify the remote system that Webwasher should relay e-mails to.
— Description
Input in this field is optional. You can enter a text string here describing
the system entered above.

— use encrypted communication
Proxies
Mark the checkbox next to these words if a TLS encrypted connection
is required for relaying e-mails to this system.
After specifying the appropriate information, click on the Add Entry button to
add the new entry to the list.
If this action was successful, the entry is added to the list, which is displayed
at the bottom of this section. For each entry, the list provides the information
that is specified when a new entry is added (see above).
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input fields of the Domain or
Comment column or enable or disable the checkbox in the column labeled
Use TLS. Then click on Apply Changes to make this setting effective. You
can edit more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field of the Domain or Comment column
or in both and enter it using the Enter key of your keyboard. The list
will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there is
more than one entry in the list containing information on a particular mail
server or gateway, the entry that is first in the list wins.
5–125

Proxies
This means, e. g., that if the first entry for a particular mail server has
the Use TLS feature disabled, no TLS encryption will be used for relaying
e-mails to this server, although there may be an entry later on in the list for
this same server with TLS encryption enabled.
5.7
Queue Configuration
The Queue Configuration options are invoked by clicking on the corresponding
button under Proxies:
The options are arranged under the following tab:
They are described in the upcoming section:
• Queue Configuration, see 5.7.1
5.7.1
Queue Configuration
5–126
The Queue Configuration tablookslikethis:

There is one section on this tab:
• Queue Configuration
It is described in the following.
Queue Configuration
The Queue Configuration section looks like this:
Proxies
Using this section, you can configure the message queues for the SMTP gateway.
A list of existing queues is displayed here. You can edit queues, create
new ones, move them up and down within the list and delete them.
Note that for any changes to take effect, you have to restart Webwasher manually.
Use the following items to configure message queues:
• Filter
Type a filter expression in the input field of the Queue Name column and
enter it using the Enter key of your keyboard. The list will then display only
entries matching the filter.
• Edit
Click on this button to edit the corresponding queue. This will take you to
another tab, where you can specify the appropriate changes.
5–127

Proxies
• Delete Selected
Select the queue you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one queue in one
go.
To delete all queues, mark the Select all checkbox and click on this button.
• Create New
After clicking on this button a new queue is added to the list, which is named
NewQueue. ClickontheEdit button to go to another tab, where you can
specify further information regarding this queue.
• Move Up Selected, Move Down Selected
Select the queue you wish to move by marking the Select checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position a queue takes in the list is important since whenever there are
queues in the list that have been configured to accept incoming e-mails, the
first queue in the list wins, which means that incoming e-mails are directed
to it and not to the queues following it in the list.
So, you might have configured a Problemincoming queue for processing
e-mails, where the sender domain cannot be resolved. At the same
time, there is the Inbound queue, which accepts all incoming e-mails. If
the Inbound queue is placed in the list before Problemincoming queue,
no e-mails will ever reach the Problemincoming queue because the Inbound
queue gets all incoming e-mails, the unresolvables, as well as any
others.
5.8
Relay Protection
5–128
The Relay Protection Options options are invoked by clicking on the corresponding
button under Proxies:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Allowed Domains, see 5.8.1

• IP Networks, see 5.8.2
• Recipient LDAP Check, see 5.8.3
5.8.1
Allowed Domains
The Allowed Domains tab looks like this:
At the top of this tab is a button labeled:
• Define IP Networks
ClickonthisbuttontogototheIP Networks tab.
Proxies
When configuring mapping rules for allowed domains, networks need also
to be configured. This is done on the IP Networks tab.
Furthermore, there are three sections on this tab:
• Shell Expressions
• Add Rule
• Current Rules
They are described in the following.
5–129

Proxies
5–130
Shell Expressions
The Shell Expressions section looks like this:
It allows you to configure the use of shell expressions when specifying the
domains that are allowed to be relayed. Furthermore, you can configure a
string for separating domain entries here.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
To enable the use of shell expressions, mark the checkbox next to the section
heading.
To configure a separator, use the following input field:
• Values separation string
Enter the string you want to use for separating domain entries here.
The default separator is the , (comma).
Add Rule
The Add Rule section looks like this:
Using this section, you can configure the domains that incoming e-mail messages
may be relayed to.
After mapping these domains to client IPs, messages sent from there will be
accepted by Webwasher. If no mapping is configured here only messages sent
from the local host will be accepted.
In order to be mapped, a client IP must also have been configured in the Add
Rule section of the IP Networks tab, see 5.8.2.

Proxies
So, e. g. if all incoming messages should be relayed to your corporate network
by Webwasher, the rule could be as follows:
internet=yourcompany.com
In order to make this a valid rule, however, you also need to configure internet
on the IP Networks tab, e. g. using an * (asterisk) to include all client IPs.
Enter a mapping rule you want to configure in the input field provided here.
The input format is:
IP network = (domain [, domain] | *)
After entering a rule, click on the Add First or Add Last button. The rule will
then be added to the list in the corresponding position.
The list is displayed in the Current Rules section, see below.
Current Rules
The Current Rules section looks like this:
It displays a list of the rules that have been configured to map networks to
domains for relay protection.
You can edit rules, move them up and down in the list, or delete them.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard. If the number of entries is higher than this number,
the remaining entries are shown on successive pages. A page indicator is then
displayed, where you can select a particular page by clicking on the appropriate
arrow symbols.
To edit a rule, type the appropriate text in the input field of the Rule column.
Then click on Apply Changes to make this setting effective. You can edit
more than one rule and make the changes effective in one go.
5–131

Proxies
Use the following items to perform other activities relating to the list:
• Filter
5.8.2
IP Networks
5–132
Type a filter expression in the input field below the Rule column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there is
more than one entry in the list containing information on a particular network
or domain, the entry that is first in the list wins.
The IP Networks tab looks like this:

There are two sections on this tab:
• Add Rule
• Current Networks
They are described in the following.
Add Rule
The Add Rule section looks like this:
Proxies
Using this section, you can configure networks my mapping them to client IP
adresses.
Networks that have been configured in this way, may be specified when configuring
mapping rules for domains on the Allowed Domains tab, see 5.8.1.
Enter a mapping rule you want to configure in the input field provided here.
The input format is:
network = (IP [, IP] | IP/NetMask | IP range | *)
network=* means that the provided network name will be mapped to all possible
IP addresses, i. e.. 1.0.0.0 – 233.255.255.255.
After entering a rule, click on the Add First or Add Last button. The rule will
then be added to the list in the corresponding position.
The list is displayed in the Current Rules section, see below.
5–133

Proxies
5–134
Current Networks
The Current Networks section looks like this:
It displays a list of the rules that have been configured to map networks to IP
addresses.
You can edit rules, move them up and down in the list, or delete them.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit a rule, type the appropriate text in the input field of the Rule column.
Then click on Apply Changes to make this setting effective. You can edit
more than one rule and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field below the Rule column and enter
it using the Enter key of your keyboard.
The list will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.

• Move Up, Move Down
Proxies
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there is
more than one entry in the list containing information on a particular network
or domain, the entry that is first in the list wins.
5.8.3
Recipient LDAP Check
The Recipient LDAP Check tab looks like this:
At the top of this tab, there is a checkbox and a button
• Enable recipient LDAP check
Enable this option to configure an LDAP check for recipient domains, using
the items provided in the section below.
• Configure LDAP Server
To configure an LDAP server, which is needed in order to perform a recipient
LDAP check, click on this button. This will take you to the LDAP
Connection tab, where you can configure thes server.
The options of this tab correspond to that of the LDAP Synchronization
tab, see 2.4.3.
5–135

Proxies
5–136
In addition to the options that are described there, the LDAP Connection
tab includes the UID value prefix option when provided for configuring
settings of the e-mail gateway.
This value is prefixed by some servers to the e-mail address that is an attribute
of the user information stored on the LDAP server in order to specify
the protocol. The default for it is SMTP.
Furthermore, there is one section on this tab:
• Domain for LDAP check
It is described in the following.
Domain for LDAP Check
The Domain for LDAP check section looks like this:
Using this section, you can add a domain to the list of domains that an LDAP
check is performed for.
To add a recipient domain to the list, use the area labeled:
• Add new recipient domain
Enter the domain you want to have an LDAP check performed for in the
input field provided here, e. g. company.mail.
Configure also the following two options, i. e. enable or disable them:
— deactivate
Enable this option if you want to just enter the domain in the list, but
not yet activate the checking function.

Proxies
This may be done later by marking the corresponding checkbox in the
list, see below.
— do not reject
Enable this option to have e-mails from all senders of the configured
domain rejected, with the exception of the sender specified here.
This option can also be modified by editing the list, see below.
Then click on the Add to Domain List button.
If this action was successful, the entry is added to the list, which is displayed
at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To sort the list in ascending or descending order, click on the symbol next to
the Domain column heading.
To edit an entry, type the appropriate text in the input field of the Domain
column and enable or disable the deactivate and do not reject checkboxes.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field of the Domain column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
5–137

Proxies
5.9
Exception Lists
5.9.1
IP White List
5–138
The Exception Lists options are invoked by clicking on the corresponding
button under Proxies:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• IP White List, see 5.9.1
• IP Black List, see 5.9.2
• Client Domain Black List, see 5.9.3
• Sender Black List, see 5.9.4
• Recipient Black List, see 5.9.5
• TrustedSource, see 5.9.6
The IP White List tab looks like this:

There are two sections on this tab:
• Add Rule
• Current Networks
They are described in the following.
Add Rule
The Add Rule section looks like this:
Proxies
It allows you to add an address or a range of addresses to the White List for
the SMTP gateway. If an IP address is on this list, it means that a client with
this address will always be allowed to connect to the gateway.
Enter the rule you want to add to the list in the input field provided here. The
input format is:
network = ( IP [, IP] | IP/NetMask | IP range) | *
After entering a value, click on the Add First or Add Last button. A new entry
will then be added to the list in the corresponding position.
The list is displayed in the Current Networks section below.
Current Networks
The Current Networks section looks like this:
5–139

Proxies
5–140
It displays a list of the IP addresses or ranges of addresses that have been
included in the White List for the SMTP gateway.
For each entry, it provides the information that is specified when a new entry
is added (see above). You can edit list entries, move them up and down in the
list, or delete them.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard. If the number of entries is higher than this number, the
remaining entries are shown on successive pages. A page indicator is then
displayed, where you can select a particular page by clicking on the appropriate
arrow symbols.
To edit an entry, type the appropriate text in the input field of the Rule column.
Then click on Apply Changes to make this setting effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field below the Rule column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there
is more than one entry in the list containing information on a particular IP
address, the entry that is first in the list wins.

5.9.2
IP Black List
The IP Black List tab looks like this:
There are two sections on this tab:
• Add Rule
• Current Networks
They are described in the following.
Add Rule
The Add Rule section looks like this:
Proxies
It enables you to add an IP address or a range of addresses to the Black List
for the SMTP gateway. If an IP address is on this list, it means that a client
with this address will not be allowed to connect to the gateway.
Enter the address you want to have blacklisted in the input field provided here.
5–141

Proxies
5–142
The input format is:
network = ( IP [, IP] | IP/NetMask | IP range) | *
After entering a value, click on the Add First or Add Last button. A new entry
will then be added to the list in the corresponding position.
The list is displayed in the Current Networks section below.
Current Networks
The Current Networks section looks like this:
It displays a list of the IP addresses or ranges of addresses that have been
included in the Black List for the SMTP gateway.
For each entry, it provides the information that is specified when a new entry
is added (see above). You can edit list entries, move them up and down in the
list, or delete them.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard. If the number of entries is higher than this number, the
remaining entries are shown on successive pages. A page indicator is then
displayed, where you can select a particular page by clicking on the appropriate
arrow symbols.
To edit an entry, type the appropriate text in the input field of the Rule column.
Then click on Apply Changes to make this setting effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field below the Rule column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.

• Delete Selected
Proxies
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Move Up, Move Down
SelecttheentryyouwishtomovebymarkingtheSelect checkbox next
to it and click on either of these buttons, depending on where you want to
move the entry.
The position an entry takes in the list is important since whenever there
is more than one entry in the list containing information on a particular IP
address, the entry that is first in the list wins.
5.9.3
Client Domain Black List
The Client Domain Black List tab looks like this:
There is one section on this tab:
• Client Domain Black List
It is described in the following.
5–143

Proxies
5–144
Client Domain Black List
The Client Domain Black List section looks like this:
It allows you to add a domain to the Client Domain Black List for the SMTP
gateway.
If a domain is on this list, a client with an IP address belonging to this domain
will be treated in one of the following two ways when sending a request:
• The client is not allowed to connect to the server.
• The client is allowed to connect to the server, but e-mails sent using this
connection are not accepted.
Which of these two methods is used, depends on a parameter that is set in the
Load Limits section of the Load Limits tab, see 5.10.1.
The parameter is labeled Do not accept connection if client domain is in
theblacklistorserverisoverloaded.Ifitisenabled, the first of the two
methods is used, otherwise the second is used.
A reverse DNS lookup is performed to determine whether a client address belongs
to particular domain.
Note: The Client Domain Black List allows to easily block e-mails from dial-up
users, e. g. mails from tisdip.tiscali.de, which is a dial-up domain used by
Tiscali, or from dip0.t-ipconnect.de and dip.t-dialin.net, which are dial-up
domains for Telekom. In general, users will use mail servers that have been
set up by their providers, rather than running their own SMTP servers on their
home computers. So, e. g., Telekom users would use one of the following
servers: smtprelay.t-online.de, securesmtp.t-online.de or smtpmail.tonline.de,
and Tiscali users would use smtp.tiscalinet.de.

To add a domain to the list, use the area labeled:
• Add new domain
Proxies
Enter the domain you want to have blacklisted in the input field provided
here, e. g. company.mail.
Configure also the following two options, i. e. enable or disable them:
— deactivate
Enable this option if you want to just enter the sender in the list, but not
yet activate the filtering function.
This may be done later by marking the corresponding checkbox in the
list (see below).
— do not reject
Enable this option to have e-mails from all senders of the configured
domain rejected, with the exception of the sender specified here.
This option can also be modified by editing the list (see below).
Then click on the Add to Blacklist button.
If this action was successful, the entry is added to the list, which is displayed
at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To sort the list in ascending or descending order, click on the symbol next to
the Domain column heading.
To edit an entry, type the appropriate text in the input field of the Domain
column and enable or disable the deactivate and do not reject checkboxes.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field of the Domain column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
5–145

Proxies
• Delete Selected
5.9.4
Sender Black List
5–146
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
The Sender Black List tab looks like this:
There is one section on this tab:
• Sender Black List
It is described in the following.

Sender Black List
The Sender Black List section looks like this:
Proxies
It allows you to add a sender to the Sender Black List for the SMTP gateway.
If a sender is on this list, e-mails from this sender will be rejected even before
they are accepted.
To add a sender to the list, use the area labeled:
• Add new sender
Enter the sender you want to have blacklisted in the input field provided
here, e. g. company.mail.
Configure also the following two options, i. e. enable or disable them:
— deactivate
Enable this option if you want to just enter the sender in the list, but not
yet activate the filtering function.
This may be done later by marking the corresponding checkbox in the
list (see below).
— do not reject
Enable this option to have e-mails from all senders of the configured
domain rejected, with the exception of the sender specified here.
This option can also be modified by editing the list (see below).
Then click on the Add to Sender Black List button.
5–147

Proxies
5–148
If this action was successful, the sender is added to the list, which is displayed
at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To sort the list in ascending or descending order, click on the symbol next to
the Domain column heading.
To edit an entry, type the appropriate text in the input field of the Domain
column and enable or disable the deactivate and do not reject checkboxes.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field of the Domain column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.

5.9.5
Recipient Black List
The Recipient Black List tab looks like this:
There is one section on this tab:
• Recipient Black List
It is described in the following.
Proxies
5–149

Proxies
5–150
Recipient Black List
The Recipient Black List section looks like this:
It allows you to add a recipient to the Recipient Black List for the SMTP gateway.
If a recipient is on this list, e-mails to this recipient will be rejected even before
they are accepted.
To add a recipient to the list, use the area labeled:
• Add new recipient
Enter the recipient you want to have blacklisted in the input field provided
here, e. g. company.mail.
Configure also the following two options, i. e. enable or disable them:
— deactivate
Enable this option if you want to just enter the recipient in the list, but
not yet activate the filtering function.
This may be done later by marking the corresponding checkbox in the
list (see below).
— do not reject
Enable this option to have e-mails from all recipients of the configured
domain rejected, with the exception of the recipient specified here.
This option can also be modified by editing the list (see below).
Then click on the Add to Recipient Black List button.

Proxies
If this action was successful, the recipient is added to the list, which is displayed
at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To sort the list in ascending or descending order, click on the symbol next to
the Domain column heading.
To edit an entry, type the appropriate text in the input field of the Domain
column and enable or disable the deactivate and do not reject checkboxes.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field of the Domain column and enter it
using the Enter key of your keyboard. The list will then display only entries
matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
5–151

Proxies
5.9.6
TrustedSource
5–152
The TrustedSource tab looks like this:
There is one section on this tab:
• TrustedSource Score
It is described in the following.

TrustedSource Score
The TrustedSource Score section looks like this:
Proxies
Using this section, you can configure the rejection of e-mails depending on
an evaluation of their sender IP addresses. This evaluation is performed using
DNS queries that are sent to the TrustedSource server, from where a reputation
score is returned.
This feature is not enabled by default. If you want to use it, mark the checkbox
next to the section heading. After specifying this setting or after modifying the
score setting, click on Apply Changes to make these settings effective.
Use the following input field to modify the TrustedSource score:
• Reject connection if score is more than
Enter a value here for the reputation score. If the TrustedSource server
returns a score higher than this value for a sender IP address, the e-mail
in question will be rejected.
A score higher than 80 means that no legitimate traffic is to be expected
from a sender. For this reason, 80 is the default value.
5–153

Proxies
5.10
Load Limits
5.10.1
Load Limits
5–154
The Load Limits options are invoked by clicking on the corresponding button
under Proxies:
The options are arranged under the following tab:
They are described in the upcoming section:
• Load Limits, see 5.10.1
The Load Limits tab looks like this:

There are three sections on this tab:
• Load Limits
• DoS Attack
• Gateway Performance
They are described in the following.
Load Limits
The Load Limits section looks like this:
Proxies
Using this section, you can configure load limits to determine when the server is
overloaded. Limits may depend on various criteria, such as the size of e-mails
sent to the server, the volume of mail queues, or the number of recipients of
an e-mail.
After reaching a configured load limit, the server is overloaded. If a client sends
an e-mail to the overloaded server, the connection is accepted, but a message
will be sent in return informing the client about this overload. The e-mail sent
by the client will not be accepted.
If the server is overloaded, it continues with processing e-mails that were accepted
so far. This means the number of e-mails still in the queues will eventually
reach a level below the configured load limits. As soon as this is the case,
new connections and e-mails will be accepted.
So, if a configured load limit of, e. g. 10,000 e-mails has been reached for
the inbound queue, and the server processes one e-mail, the actual load is
reduced to 9,999. Then the next time a client tries to connect to the server to
send an inbound e-mail, it will be accepted.
After modifying any of the settings in this section, click on Apply Changes to
make the modification effective.
5–155

Proxies
5–156
Use the following checkboxes and input fields to configure load limits:
• Do not accept connection if client domain is in the black list or
server is overloaded
Mark this checkbox if you do not want to allow a client sending an e-mail to
connect to the server in case of a server overload. The connection is then
dropped and even the return message mentioned above will not be sent.
Furthermore, the client will not be allowed to connect to the server if its IP
address belongs to a domain that has been entered in the Client Domain
Black List. A reverse DNS lookup is performed to establish the domain an
IP address belongs to.
• Do not accept mails bigger than . . . KB
Make sure the checkbox provided here is marked if you want the server
overload to depend on the size of an e-mail. The checkbox is marked by
default.
Accept the default size, or enter a different value (in KB) in the corresponding
input field. The default size is 10240 KB.
• Do not accept mails if there are more than . . . mails in the . . .
queue
Make sure the checkbox provided here is marked if you want the server
overload to depend on the number of e-mails in a particular queue, e. g.
the Inbound queue. The checkbox is marked by default. The default
values are 10000 and Inbound.
Accept the default number and queue, or enter different values in the corresponding
input fields.
• Do not accept mails if there are more than . . . mails in the . . .
queue
Make sure the checkbox provided here is marked if you want the server
overload to depend on the number of e-mails in yet another queue, e. g.
the Outbound queue. The checkbox is marked by default.
Accept the default number and queue, or enter different values in the corresponding
input fields. The default values are 10000 and Outbound.
• Donotacceptmailsiftherearemorethan...recipients
Make sure the checkbox provided here is marked if you want the server
overload to depend on the number of the recipients of an e-mail. The
checkbox is marked by default.
Accept the default number and queue, or enter a different value in the corresponding
input field. The default number is 200.

DoS Attack
The DoS Attack section looks like this:
Proxies
Using this section, you can configure actions that will be taken in case a DoS
(Denial of Service) attack has been attempted against the SMTP gateway.
You can also configure a time interval and volumes with regard to an attack.
Depending on these, the configured actions will take effect.
After modifying any of the settings in this section, click on Apply Changes to
make the modification effective.
Use the following checkboxes and input fields to configure DoS attack options:
• Block Gateway for . . . minutes in case of multiple clients attack
Mark this checkbox if you want to block the gateway for some time after
DoS attack by more than one client. For this time interval, accept the default
number of minutes, or enter a different number in the input field. The
default number is 6.
If there are any further requests during this time, the clients that made these
requests will not be allowed to connect to the gateway.
• Add single client to IP black list
Mark this checkbox in case a DoS attack is launched by only one client and
you want to add the client IP address to a black list.
This means that from now on, a client with this address will not be allowed
to connect to the gateway when sending a request.
To have the action executed, the attack must consist of more than a given
number of requests within a given time interval. For the corresponding
parameters, see further below.
5–157

Proxies
5–158
• Enablemessagetobewrittentosystemlog
Mark this checkbox if you want to have a message written to the system
log after a DoS attack has been launched either by a single client or by
multiple clients.
Accept the default text in the Message text input field, or enter a new one.
The default text is %d by %u (generated %t by %o).
To have the action executed, the attack must consist of more than a given
number of requests within a given time interval. For the corresponding
parameters, see further below.
• Action taken when, within a time span of . . . seconds
Accept the default interval required for a DoS attack, i. e. the interval within
which a given number of requests must have been exceeded in order to
have this classified as a DoS attack, or enter a different value in the input
field. The default interval is 60 seconds.
— a single client sends more than . . . requests
In the input field provided here, enter the number of requests sent by
a single client that must have been exceeded within the above time
interval in order to have this classified as a DoS attack. The default
number is 300.
— all clients send more than . . . requests
In the input field provided here, enter the total number of requests sent
by more than one client that must have been exceeded within the above
time interval in order to have this classified as a DoS attack. The default
number is 10000.
Gateway Performance
The Gateway Performance section looks like this:

Proxies
Using this section, you can configure load limits and other measures to improve
the gateway performance.
After modifying any of the settings in this section, click on Apply Changes to
make the modification effective.
Use the following input fields and checkboxes to configure limits and other
parameters for a better gateway performance:
• Max number of filtering processes at one time
Accept the default number for these processes, or enter a different value
in this input field. The default number is 50.
• Max number of mail delivery processes at one time
Accept the default number for these processes, or enter a different value
in this input field. The default number is 50.
• Max number of mail export processes at one time
Accept the default number for these processes, or enter a different value
in this input field. The default number is 50.
• Max number of DNS check processes at one time
Accept the default number for these processes, or enter a different value
in this input field. The default number is 50.
• Adjust number of threads depending on the current load
Mark the checkbox provided here to adjust thread numbers.
• Stop gateway after . . . recoveries within last 10 minutes
Mark the checkbox provided here and accept the default number of gateway
restarts that must be exceeded before the gateway is shut down, or
enter a different value in the input field.The default number is 5.
5–159

Proxies
5.11
POP3 Access
The POP3 Access options are invoked by clicking on the corresponding button
under Proxies:
If you want to enable any of these options, you also need to mark the checkbox
that is on this button.
5.11.1
POP3 Access
5–160
Then click on Apply Changes to make this setting effective.
The options are arranged under the following tab:
They are described in the upcoming section:
• POP3 Access, see 5.11.1
The POP3 Access tab looks like this:

There is one section on this tab:
• Port Settings
It is described in the following.
Port Settings
The Port Settings section looks like this:
Proxies
Using this section, you can configure access to the POP3 server for your preferred
mail client. You need to configure the listener port for this server and
specify the IP addresses you want restrict access to the server to (if there are
any).
If you would like to use your preferred mail client to manage queues, you should
first enable POP3 Access in the navigation bar, then define the listener port for
the POP3 server and finally restrict access to specific IP addresses if necessary.
You also need to configure your mail client by setting up an Internet account
for it and specifying the incoming mail server, in this case, the Webwasher IP
address or the name of the system Webwasher is running on. Furthermore,
you need to configure the outgoing mail server.
The account name is the same as the queue name configured in the
conf/smtpqueues.dat configuration file, e. g. spam, infected, policy, etc.
The rest of the settings needs to be done in this conf/smtpqueues.dat file,
where a password will be required for each queue accessible via POP3.
After specifying the appropriate information here, click on Apply Changes to
make these settings effective.
Use the following input fields to configure access to the POP3 server:
• Port
Enter the port number for listener port on the POP3 server here.
The default port number is 110. It is highly recommended not to change it,
since many mail clients do not allow it to be configured.
5–161

Proxies
5.12
• Allow access from
ICAP(S) Server
5–162
In this input field, enter the IP addresses that you want to restrict access to
the POP3 server to.
The input format is as follows:
(IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]*.
Entering an * here would mean that every site is allowed access.
The ICAP(S) Server options are invoked by clicking on the corresponding
button under Proxies:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• ICAP(S) Server, see 5.12.1
• Server Settings, see 5.12.2
• REQMOD Settings, see 5.12.3
• RESPMOD Settings, see 5.12.4

5.12.1
ICAP(S) Server
The ICAP(S) Server tab looks like this:
There are three sections on this tab:
• Port Settings (ICAP)
• Port Settings (ICAPS)
• Client Authentication
They are described in the following.
Port Settings (ICAP)
The Port Settings section for ICAP server settings looks like this:
Proxies
5–163

Proxies
5–164
Above this section is a checkbox labeled:
• Enable ICAP server
Make sure this checkbox is marked if you want to configure the ICAP server
functions for Webwasher.
Using this Port Settings section, you can configure the listener port for the
ICAP server and who is allowed access over this port.
After specifying the appropriate settings, click on Apply Changes to make them
effective.
Use the following input fields to configure the port settings for the ICAP server:
• Port
Specify the listener port here. The input format is:
[IP]: port
The default port number is 1344.
• Allow access from
Specify the IP addresses here that should have access to the listener port.
The input format is:
(IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]*.
Note: Type * to allow everyone access.
Port Settings (ICAPS)
The Port Settings section for ICAPS server settings looks like this:
Above this section is a checkbox labeled:
• Enable ICAPS server
Mark this checkbox is marked if you want to configure the ICAPS server functions
for Webwasher.

Proxies
Using this Port Settings section, you can configure the listener port for the
ICAPS server and who is allowed access over this port.
After specifying the appropriate settings, click on Apply Changes tomake
them effective.
Use the following input fields to configure the port settings for the ICAPS server:
• Port
Specify the listener port here. The input format is:
[IP]: port
The default port number is 11344.
• Allow access from
Specify the IP addresses here that should have access to the listener port.
The input format is:
(IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]*.
Note: Type * to allow everyone access.
Client Authentication
The Client Authentication section looks like this:
Using this section, you can configure a restriction for certificates that are submitted
for client authentication. You can select a Certificate Authority (CA) and
have only certificates issued by this CA accepted.
Note that this restriction can only be configured when you are using the ICAPS
server.
If you want to use this feature, mark the checkbox next to the section heading.
After specifying this setting and selecting the CA, click on Apply Changes to
make these settings effective.
Use the following drop-down list to configure client authentication:
• Accept only certificates issued by
Select the CA you want to trust here.
5–165

Proxies
5.12.2
Server Settings
5–166
The Server Settings tab looks like this:
There are three sections on this tab:
• ICAP Options
• Additional ICAP Headers
• Remember Infected URLs
They are described in the following.

ICAP Options
The ICAP Options section looks like this:
Proxies
Using this section, you can configure a number of options with regard to ICAP
communication.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure ICAP communication:
• Never split ICAP headers
Mark this checkbox to forbid the splitting of ICAP headers for ICAP clients
that cannot handle ICAP responses with encapsulated HTTP headers and
ICAP response headers sent in separate TCP/IP packets.
• Wait for complete ICAP request
Check one of the radio buttons provided under this option to enable waiting
for the complete ICAP request in different modes.
This may be required for ICAP clients that are not able to receive parts of
the filtered HTTP response, while other parts of the same file are still being
sent to Webwasher.
Webwasher’s normal behavior is to try to filter HTTP data chunk by chunk
to reduce the latency time.
Webwasher prefers this option to be disabled, while NetCache 5.2 FCS
users running ICAP/1.0 in RESPMOD need to enable it.
NetCache 5.2R1 and later releases allow the disabling of this option.
5–167

Proxies
5–168
If you are running Webwasher together with Blue Coat’s Security Gateway
using ICAP, the option also needs to be enabled, which means you should
configure Always as value for this kind of configuration.
Use the radio buttons provided here to configure values for the Wait ...option
as follows:
— Never
Never wait for the complete ICAP request.
This value is configured by default.
— Only for FTP requests
Only wait for the complete ICAP request in case of FTP requests.
— Only for REQMOD requests
Only wait for the complete ICAP request if the ICAP client is a Bluecoat
ProxySG Appliance and at the same time the filtering of REQMOD uploads
is not enabled. Otherwise, this option is not needed for the Bluecoat
client.
To verify if the filtering of REQMOD uploads is enabled, go to the RE-
QMOD Settings tab and see if the option labeled Apply configured
filters on uploaded and posted data is enabled.
Note that if you configure this value, data trickling and progress pages
will not be activated.
— Always
Always wait for the complete ICAP request.
Note that if you configure this value, data trickling and progress pages
will not be activated.
• Do not send early 204 responses
Mark this checkbox to forbid the sending of these responses for ICAP
clients that support 204 responses at the end of ICAP messages, but do
not handle them if sent before the end of a request.
If the ICAP client supports early 204 responses (as all built-in Webwasher
ICAP clients do) you should not configure this values for better performance.
• Strict ICAP RFC compliance
Mark this checkbox to ensure that the ICAP server communication strictly
adheres to the mode specified in the corresponding RFC document.
The strict mode is, however, not supported by some ICAP clients.

• Preferred preview size
Proxies
In the input field provided here, enter the number of bytes for the preferred
preview size.
This size equals the number of bytes Webwasher shows in the OPTIONS
response. An ICAP client should send this number of bytes in a REQMOD
or RESPMOD request first.
The client should then wait for Webwasher to either indicate that the rest
of the data is also needed, or Webwasher is not interested in seeing the
data, and the file is allowed unfiltered.
The default value is 30 bytes. A value of 0 bytes means that only the ICAP
header is sent in response modification before the ICAP client waits for a
response.
To disable the option, enter a negative value here.
• Maximum chunk size
In the input field provided here, enter the maximum chunk size that should
be used in ICAP communication.
The default size is 5120 KB.
• ISTag: ...
Click on the Change ISTag Now button provided here to change the
ISTag.
The ISTag is similar to a version number for an ICAP service. Whenever
the version changes, the ICAP client will no longer use responses that
Webwasher has previously given, but will ask Webwasher again for each
request or response.
Webwasher does not increment the version number when you change
Webwasher settings or update the URL filter database, because the
changes often are not relevant enough to be applied to everyone in your
network at once.
You may prefer to configure the caching parameters, so the time span in
question does not grow too much before cached responses are automatically
invalidated.
If you decide, however, that all cached responses should be invalidated at
once, click on the button to change the ISTag, but be aware that this could
generate a higher load until the cache gets refilled.
5–169

Proxies
5–170
Additional ICAP Headers
The Additional ICAP Headers section looks like this:
Using this section, you can configure the logging of URL categories at the ICAP
client site.
Categories will appear in a log file field named Attribute, according to the
logging range you configure here
Furthermore, the field will contain information on whether the blocking was due
to RTC or the Access Control List.
Note that there is also a log file field named categories, which is not used to
store these categories and is not available at the client site.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following radio buttons and checkbox to configure the logging of URL
categories:
• Do not send categories to the ICAP client
If you do not want to have categories sent to the ICAP client make sure
this radio button is checked. The radio button is checked by default.
• Send all categories to the ICAP client
Check this radio button to have all categories sent to the ICAP client.
• Send only the blocked categories to the ICAP client
Check this radio button to have only blocked categories sent to the ICAP
client.
• Send range of values of the ’X-Attribute’ header in OPTIONS response
Mark this checkbox to enable this compatibility setting, which simplifies the
co-operation between ICAP server and client.

Proxies
The X-Attribute header is a type of REQMOD/RESPMOD header. Some
ICAP clients may require a range of values of this header in the OPTIONS
response.
So, if you are using a client that relies on this data, as is the case e. g. with
Blue Coat, you should enable this option.
Remember Infected URLs
The Remember Infected URLs section looks like this:
It allows you configure a time interval for storing the names of virus-infected
files. These files will be rejected immediately by Webwasher.
Use the following item to configure this interval:
• Virus-infected file names will be stored for ... seconds
Enter a value for the time interval (in seconds) in the input field provided
here. The default interval is 1800 seconds.
5–171

Proxies
5.12.3
REQMOD Settings
5–172
The REQMOD Settings tab looks like this:
There are three sections on this tab:
• REQMOD Options
• REQMOD Response Caching
• Additional REQMOD Response Headers
They are described in the following.

REQMOD Options
The REQMOD Options section looks like this:
Proxies
Using this section, you can configure the way ICAP requests are modified.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following items to configure ICAP request modification:
• Handle internal requests in REQMOD
Enable this option to handle internal request in REQMOD.
Due to restrictions in version 1.0 of the ICAP protocol, internal requests,
such as access to the Webwasher Web interface, can usually not be handled
in REQMOD communication.
These are requests that address Webwasher under the name of
-web.washer-. If your ICAP client is able to accept non-error HTML data
in REQMOD satisfaction responses, you can use the option described
here to handle these requests also in REQMOD communication.
• Apply configured filters on uploaded and posted data
Enable this option to apply configured filters on uploaded and posted data.
This will let the REQMOD server look into the body of a request, which is
a useful feature for URL filtering on parameters, Anti Virus scanning and
blocking files by media type.
• Retain original ’User Agent’ field
Enable this option to retain the original User Agent field.
5–173

Proxies
5–174
Retaining this field means not to change the text string used by programs to
identify themselves towards HTTP, e-mail and news servers. This identification
is needed for usage tracking and other purposes, such as displaying
Web pages in a way that is best suited to the properties of your browser.
• Suppress unsupported content encodings
Enable this option to suppress unsupported content encodings.
The most common content encodings are UTF-8 (utf-8), andLatin-1
(iso-8859-1). There may, however, be others that are not supported, so
you can suppress them using this option.
• Forbid partial downloads (HTTP)
Enable this option to forbid partial downloads for HTTP requests.
Partial downloads can be useful when a download was aborted for one
reason or other. In this case, a client could continue the download from
where it was interrupted, rather than starting from the beginning.
Partial downloads may, however cause problems when Webwasher uses
filters such as, e. g. the Anti Virus filter since it may not be able to find a
virus in an incomplete file. Successful virus scanning might therefore be
impeded, due to partial downloads.
Unintentional partial downloads may occur when both Anti Virus and data
trickling are enabled. Webwasher may have started forwarding bytes to a
client before the connection is aborted due to a virus being found in the file.
The client becomes aware of this abort, and attempts a partial download of
the rest of that file, which may leave Webwasher unable to detect the virus.
If magic byte matching is enforced, some partial downloads may be blocked
due to an untypical file header, which also limits virus scanning capabilities.
It is therefore recommended to forbid partial HTTP downloads while the
Webwasher content security filters are enabled.
• Forbid partial file transfers (FTP)
Enable this option to forbid partial downloads for file transfers.
For the reasons given in the description of the Forbid partial downlloads
(HTTP) optio, it is also recommended to forbid partial FTP downloads while
the Webwasher content security filters are enabled.
• REQMOD resource name
In this input field, enter the name of the resource used for REQMOD communication.

Proxies
This name should correspond to the resource name for request modification
that has been configured on the ICAP client.
• Max REQMOD connections
In the input field provided here, enter the number of connections an ICAP
client is allowed to open as a maximum
Webwasher does not have a limit for the connection count, but there may
be restrictions due to the hardware or operating system you are using.
Also, the more filters are enabled and the more connections are open at the
same time, the more time Webwasher needs to handle an individual ICAP
request. So if this value is set very high, an ICAP client might think that
Webwasher is no longer responding since the response time has grown
too much.
In case your ICAP client tells you that it cannot handle more connections,
but your ICAP server is not on very high load, increase this value.
If your ICAP client believes that Webwasher is down although it is still running,
decrease this value.
REQMOD Response Caching
The REQMOD Response Caching section looks like this:
Using this section, you can configure the way REQMOD response are cached.
The ICAP server either sends a modified version of the request back to the
ICAP client, a valid HTTP response such as an error message saying access
to a particular URL is not allowed, or, if the client indicates that it supports 204
responses, an indication that no modification is required.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
5–175

Proxies
5–176
Use the following items to configure REQMOD response caching:
• Cacheability
From the drop-down list provided here, select a value to let the ICAP client
cache responses for everyone at all times, for the current user group, or
for a single user only.
When running multiple Webwasher group policies, a REQMOD response
may not be valid for everybody. By default, Webwasher determines for
what group the response is valid by the chosen policy method. By selecting
a different value here, you can override Webwasher.
Note that a response cannot be cached if the HTTP request was modified
by the Cookie Filter, the Referer Filter or the appended User Agent.
• Default Caching Age
In the input field provided here, enter a time interval to determine how long
a response is cached.
The caching age is usually determined by the time schemes that have been
set for a given URL filter database category. If a category is allowed until 3
p.m., the response for a URL falling in this category will also be valid until 3
p.m. If a URL is not in the URL filter database, the caching value configure
here is used for it.
Note that a response cannot be cached if the HTTP request was modified
by the Cookie Filter, the Referer Filter or the appended user agent.
• Min Caching Age
In the input field provided here, enter a time interval to determine how long
a response is cached at least.
Use this option to make sure a given URL is not requested again and again
in very short intervals, although it is not cacheable. Regardless of what was
calculated, the caching interval will never be smaller than this value.
Note that this could disable privacy filters if caching is forced to get responses
that should not be cached.
To disable the Webwasher cache-control feature, specify a negative value
for this option, as well as for Max Caching Age, see below.
• Max Caching Age
In the input field provided here, enter a time interval to determine how long
a response is cached as a maximum.
Use this option limit the time responses are cached. Regardless of what
was calculated, the caching interval will not be greater than this value.

Proxies
This can be very useful if you do not like changing the ISTag with every to
Webwasher or URL filter database change. The ICAP client will ask Webwasher
after this maximum value has been set to re-validate the response.
To disable the Webwasher cache-control feature, specify a negative value
for this option, as well as for Min Caching Age, see above
Enter the ICAP client services to use for RESPMOD here. You can enter
multiple services, separated by a |.
Additional REQMOD Response Headers
The Additional REQMOD Response Headers section looks like this:
Using this section, you can configure one or more additional REQMOD response
headers. These will provide additional information, such as date, size,
server data, etc,. that a Web server sends back to a client browser in response
to receiving an HTTP request.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following input field to configure additional headers:
• Header Definition
Specify the additional REQMOD response headers here. The input format
is:
Header = Value[, Header = Value]
5–177

Proxies
5.12.4
RESPMOD Settings
5–178
The RESPMOD Settings tab looks like this:
There are two sections on this tab:
• RESPMOD Options
• Additional RESPMOD Response Headers
They are described in the following.
RESPMOD Options
The RESPMOD Options section looks like this:
Using this section, you can configure the way ICAP responses are modified.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.

Use the following items to configure ICAP response modification:
• Use URL Filtering in RESPMOD (HTTP, FTP)
Proxies
Enable this option to perform URL filtering in RESPMOD (HTTP, FTP) communication.
This will increase system load compared to filtering URLs in REQMOD
communication, but is still an option in case REQMOD communication is
not available on your preferred ICAP client.
You can also enable the following sub-option:
— but determine categories only
With this sub-option enabled, disallowed categories will only be written
to the log files. If the sub-option is not enabled, these categories will
be blocked.
• Support ’X-Hash-Id’ calculation
Enable this option to support X-hash-ID calculation.
With this option enabled, NetCache is able to detect if an object is equal
to another object that was rejected according to a different policy, so Net-
Cache would not unnecessarily store another copy of it.
This feature uses a combination of information on policies and a hash over
the object in question.
• RESPMOD resource name
In this input field, enter the name of the resource used for RESPMOD communication.
This name should correspond to the resource name for request modification
that has been configured on the ICAP client.
• Max RESPMOD connections
In the input field provided here, enter the number of connections an ICAP
client is allowed to open as a maximum
Webwasher does not have a limit for the connection count, but there may
be restrictions due to the hardware or operating system you are using.
Also, the more filters are enabled and the more connections are open at the
same time, the more time Webwasher needs to handle an individual ICAP
request. So if this value is set very high, an ICAP client might think that
Webwasher is no longer responding since the response time has grown
too much.
5–179

Proxies
5–180
In case your ICAP client tells you that it cannot handle more connections,
but your ICAP server is not on very high load, increase this value.
If your ICAP client believes that Webwasher is down although it is still running,
decrease this value.
Additional RESPMOD Response Headers
The Additional RESPMOD Response Headers section looks like this:
Using this section, you can configure one or more additional RESPMOD response
headers. These will provide additional information, such as date, size,
server data, etc,. that a Web server sends back to a client browser in response
to receiving an HTTP request.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following input field to configure additional headers:
• Header Definition
Specify the additional RESPMOD response headers here. The input format
is:
Header = Value[, Header = Value]
The following input field is provided in this section:
• Do not use ICAP service for URLs that match
When a request is made for a site that is entered here, the ICAP server will
not be bypassed. Specify a site by entering its IP address, host name, or
URL.
Separate multiple entries by beginning each of them in a new line.

5.13
Progress Indication Methods
Proxies
The Progress Indication Methods options are invoked by clicking on the
corresponding button under Proxies:
The options are arranged under the following tab:
They are described in the upcoming section:
• Progress Indication Methods, see 5.13.1
5.13.1
Progress Indication Methods
The Progress Indication Methods tab looks like this:
There are four sections on this tab:
• Progress Indication Options
• Progress Pages
• Data Trickling
5–181

Proxies
5–182
• Handle Progress Queries
They are described in the following.
Progress Indication Options
The Progress Indication Options section looks like this:
It allows you to configure the time interval that is to elapse before progress
indication starts. This applies to all progress indication methods configured
under Webwasher.
After specifying the appropriate information, click on Apply Changes to make
this setting effective.
Use the following input field to configure this interval:
• Start progress indication after ... seconds
Enter the appropriate time interval (in seconds) here.
The default interval is 5 seconds.
Progress Pages
The Progress Pages section looks like this:
Using this section, you can configure the use of progress pages as method
of progress indication. Progress pages indicate to a client the progress made
when an object is downloaded and filtered.

Proxies
On a progress page, there are two buttons to stop a download or to stop it and
return to the starting page:
• Cancel
Clicking on this button will stop a download that is in progress immediately.
• Back
Clicking on this button will stop a download that is in progress after 12 to
20 seconds and return to the page from where it was started.
If the Webwasher Internet Explorer Plugin is installed, no progress pages will
be displayed, see the Handle Progress Queries section below.
To configure progress pages, make sure the checkbox next to the section heading
is marked. After specifying the appropriate information, click on Apply
Changes to make your settings effective.
Use the following items to configure progress pages:
• Use progress pages only for these clients
Specify the clients you want to configure progress pages for in this input
field.
Enter user agent names to specify clients and separate them by the | (pipe
sign).
• Update Interval ... seconds
In the input field provided here, enter the time (in seconds) that is to elapse
before the next update of a progress page is performed.
The default interval is 5 seconds.
• Force sending progress page before filtering archives bigger than
... KB
Use this option to specify that progress pages are used before the filtering
of an archive begins, whenever its size exceeds a given value.
Enter this value (in KB) in the input field provided here.
5–183

Proxies
5–184
Data Trickling
The Data Trickling section looks like this:
Using this section, you can configure the use of the data trickling method.
This method allows you to determine the number of bytes that should be sent
to the Webwasher ICAP server in one go.
Since some browsers do not display anything at all when only very few bytes
are transferred, you can configure the size of the first forwarded chunk of data.
To configure data trickling, make sure the checkbox next to the section heading
is marked. The checkbox is marked by default.
After specifying the appropriate information, click on Apply Changes to make
your settings effective.
Use the following items to configure data trickling:
• Size of first forwarded chunk ... bytes
In the input field provided, here enter a byte value to specify the size of the
first chunk that is forwarded when data trickling is enabled.
• Forward ... bytes for every ... KBs received
Use this option, to specify the sizes of the data chunk (in bytes) that is
forwarded after receiving a data chunk of a given size (in KB).
Use the two drop-down lists provided here to select the corresponding values.
• Continue trickling during filtering
Enable this option to ensure that data trickling is continued during the filtering
process.
• Ensure trickling during filtering archives bigger than ... KB
Enable this option, to ensure that data trickling is used whenever the size
of an archive that is being filtered exceeds a given value.

Enter a value for this size (in KB) in the input field provided here.
Handle Progress Queries
The Handle Progress Queries section looks like this:
Proxies
Using this section, you can configure an alternative progress dialog, showing
the download progress made on the Webwasher server.
To implement this dialog, you need to install the Webwasher Internet Explorer
Plugin. If it is installed, the pages described in the Progress Pages section
above will not be shown.
Progress queries are requests that a client sends to Webwasher to inquire
about the download progress of a pending file.
In order to enable progress queries mark the checkbox next to the section
heading and click on Apply Changes to make this setting effective.
The plugin mentioned above can be obtained from the Webwasher extranet.
To go there, click on the link provided here.
After its installation, the plugin will display the download progress in three
stages:
• First, Webwasher downloads a file from the Internet and, depending on the
media type, starts scanning it. During this stage, the built-in download dialog
of the browser will proceed slow (given that Data Trickling is enabled
at all), but the Webwasher progress dialog allows to track how far the file
has been downloaded to the Webwasher server.
• When the Webwasher progress dialog shows the download as completed,
the Webwasher server may still be scanning the file. This stage may take
a while for some large archives.
• As soon as Webwasher has completed scanning, the file will be completely
delivered to the client system and the built-in browser download dialog will
begin to proceed very fast.
The plugin supports Internet Explorer versions 5.0, 5.5 and 6.0 running on
Windows 98/Me and Windows NT/2000/XP.
When deploying it to client systems via NT logon script or Windows 2000 Group
Policy, you can run a setup package, e. g. wwieplugin100-1066.exe /s,
for unattended installation.
5–185

Proxies
5.14
Own Host Name
The Own Host Name options are invoked by clicking on the corresponding
button under Proxies:
The options are arranged under the following tab:
They are described in the upcoming section:
• Own Host Name, see 5.14.1
5.14.1
Own Host Name
5–186
The Own Host Name tab looks like this:
There are three sections on this tab:
• Internal Requests
• End User Requests
• Proactive Scanning

They are described in the following.
Internal Requests
The Internal Requests section looks like this:
Proxies
Using this section, you can configure the use of an own host name for Webwasher.
This may be needed, e.g. in the default error messages for including the Webwasher
icon or in cleaned-up HTML code to insert place holder items. Depending
on the network configuration, Webwasher can then be accessed one
or the other way.
Use the radio buttons described below to configure an own host name for Webwasher.
Then click on Apply Changes to make your settings effective.
The following options can be configured:
• Use IP address of machine running Webwasher
The IP address of the machine running Webwasher can be used inmost
environments and is the default option for deployments with external ICAP
clients.
Webwasher can then be accessed using an address and path name, such
as, e. g.:
http://127.0.0.1:9090/wwfile?name=images/logo_ww.gif
• Use the internal Host -web.washer-
This internal URL can be used when Webwasher is addressed as a proxy
server from all clients.
Webwasher can then be accessed using an address and path name, such
as, e. g.:
http://-web.washer-/wwfile?name=images/logo_ww.gif
The -web.washer- part of the address will direct the browser to the Webwasher
proxy.
5–187

Proxies
5–188
Note: This option will only work for REQMOD communication, which
means that a REQMOD service must have been enabled on the client in
question. Furthermore, the server must be told to handle internal requests
in REQMOD.
To configure this, go to the REQMOD Settings tab under Proxies >
ICAP(S) Server. IntheREQMOD Options section, make sure the option
labeled Handle internal requests in REQMOD is enabled, see 5.12.3.
• Use the internal Path -web.washer-
This internal path can be used when Webwasher is addressed as a transparent
proxy server from all clients. In this case, it may not be possible to
connect to the Webwasher application directly.
Webwasher can then be accessed using an address and path name, such
as, e. g.:
/-web.washer-/wwfile?name=images/logo_ww.gif
In this case, the browser would not know that it is actually addressing Webwasher,
and only a relative path name is given. Again, the -web.washerpart
of the address will ensure that the appropriate location is reached.
Note: This option will only work for REQMOD communication, which
means that a REQMOD service must have been enabled on the client in
question. Furthermore, the server must be told to handle internal requests
in REQMOD.
To configure this, go to the REQMOD Settings tab under Proxies >
ICAP(S) Server. IntheREQMOD Options section, make sure the option
labeled Handle internal requests in REQMOD is enabled, see 5.12.3.
• Use other host or URL
Another host or URL should only be used if there is no contact from the
intranet to the system Webwasher is running on, or if you know the Webwasher
address better than Webwasher itself.
If Webwasher cannot be contacted, enter any other accessible Web server
here, as well as a path on that server in order to specify the location that
files need to be copied to from the Webwasher installation.
Please contact the Webwasher support team for further information.

End User Requests
The End User Requests section looks like this:
Proxies
Using this section, you can configure a host name for end users to contact
Webwasher upon receiving an SMTP digest.
If an SMTP Digest is distributed, the recipients need to contact Webwasher to
have their messages released or deleted. Depending on the network configuration,
Webwasher can be accessed one or the other way.
Use the radio buttons described below to configure a host name for Webwasher.
Then click on Apply Changes to make your settings effective.
The following options can be configured:
• Use IP address of machine running Webwasher
The IP address of the machine running Webwasher can be used in most
environments and is the default option for deployments with external ICAP
clients.
• Use the internal URL -web.washer-
The internal URL can be used by all clients for addressing Webwasher as
a proxy server.
• Use other host or URL
Another host or URL should only be used if there is no connection from
the intranet to the system Webwasher is running on, or if you know the
Webwasher address better than Webwasher itself.
If Webwasher cannot be contacted, enter any other accessible Web server
here, as well as a path on that server in order to specify the location that
files need to be copied to from the Webwasher installation.
Please contact the Webwasher support team for further information.
5–189

Proxies
5.15
IFP
5–190
Proactive Scanning
The Proactive Scanning section looks like this:
Using this section, you can configure a host specification for requests directed
to the Proactive Scanning filter of Webwasher.
After specifying this information, click on Apply Changes to make this setting
effective.
Use the following radio buttons and input field to specify a host for Proactive
Scanning requests:
• Use IP address of machine running Webwasher
If you want to use the IP address of the machine running Webwasher for
specifying the host, make sure this radio button is checked. The radio button
is checked by default. The IP address can be used in transparent proxy
mode, for deployments with external ICAP clients, and in other configurations.
• Use host ...
Specify another host name you want to configure in the input field provided
here.
The -web.washer- host name when Webwasher is immediately addressed
as proxy server. It is the default name for this option.
The IFP options are invoked by clicking on the corresponding button under
Proxies:
The options are arranged under the following tabs:

5.15.1
Settings
They are described in the upcoming sections:
• Settings, see 5.15.1
• ICAP Services, see 5.15.2
The Settings tab looks like this:
There are two sections on this tab:
• TCP Port Settings
• Filter Message Mode
They are described in the following.
TCP Port Settings
The TCP Port Settings section looks like this:
Proxies
5–191

Proxies
5–192
Using this section, you can configure the listener port of an IFP server and who
is allowed access over this port.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following input fields to configure these port settings:
• Port
Specify the listener port here. The input format is:
[IP]: port
The default port number is 4005.
• Allow access from
Use this field to configure the IP addresses that should have access to
each listener port that is opened by Webwasher.
The input format is:
(IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]*.
Note: Type * to allow everyone access.
Filter Message Mode
The Filter Message Mode section looks like this:
Using this section, you can configure the sending of filter messages to the user.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure the filter message mode:
• Send directly
Enable this option to send the content of a filter message to the IFP client,
from where it is forwarded to its final destination.
This is the preferred method since it is more efficient with regard to time
and memory. It is also the default option.

5.15.2
ICAP Services
Proxies
In the following situations, however, a direct sending may fail:
— An error page + HTTP header is larger than 3071 bytes.
— An IFP client fails to forward data because there are ASCII 0 characters
in between.
This may occur if:
Content encoding GZIP is used for filter messages.
Customer-defined filter messages are sent in UTF-16 or other encodings.
• Use redirect mechanism
Enable this option to save the content of a filter message locally, i. e. on
the IFP server, and send its URL for access to this content to the IFP client,
from where it is again forwarded to the user.
The user needs to send another request in order to retrieve the message
content.
The ICAP Services tab looks like this:
There are two sections on this tab:
• Services
• List of Available ICAP Services
5–193

Proxies
5–194
They are described in the following.
Services
The Services section looks like this:
Using this section, you can configure services for the IFP server communication.
Since the IFP protocol provides only the requested URL and no other
header, body or protocol information, only REQMOD services may be configured.
Note that due to the limitations of the IFP protocol, some Webwasher filters will
not be available when this protocol is used:
• Parts of the Safe Search enforcer
• Cookie filter
• Header filter
• Filters working with the body of a request, e. g. the Web Upload filter, the
Anti-Virus filter and parts of the Filter-By-Expression filter
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following input field to configure ICAP services for the IFP protocol:
• REQMOD services
Specify the service you want to configure, e. g. internal, in this input field.
To do this, type its name or select a service by selecting it from the dropdown
list next to this field. You can specify more than one services here.
The input format is:
service1 [ | service2]

5.16
WCCP
List of Available ICAP Services
The List of Available ICAP Services section looks like this:
Proxies
It displays a list of the services that are available for being configured in the
Services section above.
The WCCP options (WCCP = Web Cache Communication Protocol) are invoked
by clicking on the corresponding button under Proxies:
If you want to enable any of these options, check the checkbox on this button.
Then click on Apply Changes to make this setting effective.
Note that the WCCP options are only available under Webwasher when it is
running on an appliance.
Furthermore, these options can be used for redirecting traffic under Webwasher
with HTTP as basic protocol and version 1 or 2 of WCCP. To use them
with the HTTPS protocol, you need to have version 2 of WCCP.
The options are arranged under the following tab:
They are described in the upcoming section:
• WCCP, see 5.16.1
5–195

Proxies
5.16.1
WCCP
5–196
The WCCP tab looks like this:
There are three sections on this tab:
• WCCP
• WCCP Current Status
• Packet Forwarding
They are described in the following.

WCCP
The WCCP section looks like this:
Proxies
Using this section, you can configure some basic settings for using WCCP
within Webwasher, such as the settings of the router that will redirect traffic
under this protocol, or of the ports to which traffic should be addressed in order
to get redirected.
WCCP (Web Cache Communication Protocol) can be used with a router for
redirecting traffic to another server, which may then serve as cache or for antivirus
protection purposes. Packets that should be redirected are identified by
the router using the port numbers in their destination addresses. Packets with
non-matching port numbers will not be redirected.
The router encapsulates packets using the GRE (Generic Routing Encapsulation)
method. The Webwasher appliance receives the data and forwards it
to one of its proxy ports. The IP source address of a packet must pass the
Webwasher filter in order to get redirected.
In order to be able to use this router, you also need to configure a number of
settings that are not described here, but can be found in the documentation
delivered with it by CISCO, who are the manufacturers providing the router.
WCCP is a protocol for additional use with basic protocols, e. g. the HTTP
protocol. Note that under Webwasher it can be used with this basic protocol
only, i. e. not with HTTPS, FTP or SMTP. Furthermore, WCCP is available
under Webwasher only when it is running on an appliance.
After specifying the appropriate settings, click on Apply Changes to make
them effective. Note that for any modification of the port settings you also need
to reboot the Webwasher appliance to let the changes take effect. A Reboot
button is provided for this purpose in the last section on this tab.
Use the following items to configure basic WCCP settings within Webwasher:
• Router
In this input field, enter the IP address or DNS name of the router that
should be used for redirecting traffic.
5–197

Proxies
5–198
• WCCP v2
If you want to use version 2 of WCCP, check this radio button. Use the
following items to configure further settings for WCCP:
— Service ID
In this input field, enter a service ID, which is required for using version
2 of WCCP. The default service ID is 51.
— Ports to be forwarded
In this input field, enter the port numbers of the ports that packets
should have in their destination addresses to let the router know these
packets should be redirected.
The forwarding service that is configured under version 2 of WCCP can
provide redirection for up to 8 ports in packet destination addresses.
Note that for communication with an SSL server, you need to enter port
number 443 here since an SSL server usually listens on this port.
There are, however, SSL servers that will not listen on this port. In this
case, you also need to modify the global.conf (global.ini) configuration
file in order to enable communication. Enter the following line in
the file:
PortsTreatedAsSSL=’443, ’
Then restart Webwasher to make the modification effective.
— MD5 authentication key
In this input field, enter a key for authentication of WCCP data packets
using the MD5 digest algorithm. Use of this key is optional.
Note that this option is provided under version 2 of WCCP only.
• WCCP v1
If you want to use version 1 of WCCP, make sure this radio button is
checked. The radio button is checked by default.
Only one port is configured under this version of the protocol, which is port
80. Only packets that have this port number in their destination addresses
will be redirected.
Note also that no authentication key is used here.

WCCP Current Status
The WCCP Current Status section looks like this:
Proxies
This section provides information on some non-persistent communication parameters
of WCCP. This includes the times and dates of messages that are
exchanged between router and Webwasher appliance to handle the redirection
of data packets.
Data packets are assembled under WCCP into groups called "buckets" when
redirected for load balancing purposes. The buckets that are currently handled
by Webwasher are also displayed in this section.
If a cluster of Webwasher instances has been configured, buckets can be handled
by different instances. In this case, the instance with the lowest IP address
assigns the buckets to the other instances. This need not necessarily be the
master of the cluster.
Information is updated every few seconds by Webwasher.
The following information is displayed:
• Current time
Date and time of the information displayed in the fields below.
• Last ’HereIam’ sent
Date and time when this protocol message was last sent.
• Last ’ISeeYou’ received
Date and time when this protocol message was last received.
• Last ’Bucket assignment’ sent
Date and time of the information when an assignment of buckets, i. e.
groups of data packets, was last sent by the Webwasher instances in a
cluster.
5–199

Proxies
5–200
• Last change in group membership
Date and time of the information when the grouping of data packets into
buckets was last changed.
• This Webwasher assigns buckets
Information as to whether or not the current instance of Webwasher is the
one that assigns buckets, i. e. groups of data packets, to the other instances
in a cluster.
• Buckets assigned to
IP address of a Webwasher instance and the buckets, i. e. groups of
packets, that are currently assigned to it.
If there is a cluster of Webwasher instances, a list of all the corresponding
IP addresses and the buckets assigned to them is displayed.
Packet Forwarding
The Packet Forwarding section looks like this:
Using this section, you can configure the IP address and port number of the
server that data packets should be forwarded, i. e. redirected to, by Webwasher
under WCCP. This configuration is required if you want to use this
protocol for Webwasher. The server addresses that may be specified here are
the addresses of the network interfaces of your Webwasher appliance.
You can also specify a source IP for traffic that should be included in the forwarding,
as well as a source IP for traffic that should be excluded.
After specifying the appropriate settings, click on Apply Changes to make
them effective. Note that after modifying any of the settings in this section you
also need to reboot the Webwasher appliance in order to let the changes take
effect. A Reboot button is provided here for this purpose.

Use the following items to configure data forwarding under WCCP:
• Source IP included
Proxies
In this input field, enter a source IP address for data packets that should
be redirected in any case. A data packet will then be redirected only if
its address matches the one specified here and, furthermore, not the one
specified under Source IP exclude.
Input in this field is optional, but if it is entered, its format must be like this:
10.120.22.0/24
The last two digits are the network mask. You may also enter a part of a
source IP address.
• Source IP excluded
In this input field, enter a source IP address for data packets that should be
not be redirected. A data packet will then be redirected only if its address
does not match the one specified here and, furthermore, matches the one
specified under Source IP include
Input in this field is optional, but if it is entered, its format must be like this:
10.120.22.4/32
The last two digits are the network mask. You may also enter a part of a
source IP address.
• Redirect to
From the drop-down lists provided here, select the IP address of the server
that packets should be redirected to, as well as a port number on this server.
You may choose from the addresses of all the interface devices the Webwasher
appliance is equipped with, as well as from the addresses of the
proxy ports that are currently configured.
The proxy ports are configured on the Settings tab under Proxies > HTTP
Proxy. Remember to enable the Transparent Proxy option when configuring
a proxy there.
• Reboot
After specifying the settings in this section, or changing the port settings
in the WCCP section above, click on this button in order to make these
settings effective.
5–201

Configuration
Chapter 6
The functions described in this chapter are accessible over the Configuration
tab of the Web interface:
These functions allow you to configure features that are provided in addition to
the system configuration features already described here. Additional features
include, e. g. the update manager, central management, the action editor and
debugging.
The upcoming sections describe how to handle these functions. The description
begins with an overview.
6–1

Configuration
6.1
Overview
6–2
The following overview shows the sections that are in this chapter:
System Configuration Guide – Webwasher Web Gateway Security
Introduction
User Management
Reporting
Caching
Proxies
Configuration Overview –thissection
Update Manager, see 6.2
Central Management, see 6.3
Appliance, see 6.4
Note that the options described in this section
are only available in an appliance version of
Webwasher.
Web Interfaces, see 6.5
Secure Administration Shell, see 6.6
SNMP Interface, see 6.7
Global Command Center, see 6.8
Certificate Management, see 6.9
DNS Cache, see 6.10
Backup & Restore, see 6.11
Action Editor, see 6.12
Wizards, see 6.13
Debugging, see 6.14

6.2
Update Manager
Configuration
The Update Manager options are invoked by clicking on the corresponding
button under Configuration:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• General Options, see 6.2.1
• URL Filter, see 6.2.2
• AV Engine, see 6.2.3
• Spam Filter, see 6.2.4
• Proactive Scanning, see 6.2.5
• CRLs, see 6.2.6
6–3

Configuration
6.2.1
General Options
6–4
The General Options tablookslikethis:
There are five sections on this tab:
• Update Server Summary
• Centralized Update
• Write System Log
• Connection Options
• System Notifications
They are described in the following.

Update Server Summary
The Update Server Summary section looks like this:
Configuration
This section shows the addresses and locations of the download servers that
are currently in use for Webwasher.
Centralized Update
The Centralized Update section looks like this:
Using this section, you can configure the distribution of updates in a cluster of
Webwasher instances by the master.
Note that this will only work in a homogeneous cluster, i. e. in a cluster where
all instances of Webwasher run under the same operating system and have
the same version.
With this update method, master and sites instances in a Webwasher cluster
will behave as follows: The master distributes regular updates to the site instances.
The updates are retrieved from the Webwasher download server.
After a new update has been downloaded, the master broadcasts an update
notification to the site instances.
Before the site instances perform an update, which may be a regular update
or an update initiated manually by the user, or after receiving an update notification
from the master, they connect to the master requesting this update.
If the request fails, which can be seen from a status code other than 200 or
304, the site instances try to connect to the Webwasher download server themselves
in order to get the update.
If you want to use this update method, mark the checkbox next to the section
heading.
Then click on Apply Changes to make this setting effective.
6–5

Configuration
6–6
Write System Log
The Write System Log section looks like this:
Using this section, you can configure that information on update activities of
Webwasher is always written to a system log file. The name of this file is
update.log.
If you want to have this information written to the log file, mark the checkbox
next to the section heading.
Then click on Apply Changes to make this setting effective.
Connection Options
The Connection Options section looks like this:
Using this section, you can configure the connections to the update server.
You can configure a direct connection to this server or use a proxy.
Furthermore, you can specify how many times a retry should be performed in
case of a server overload.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure the update server connections:
• Use direct connection to update server
If you want to use a direct connection to the update server, make sure this
radio button is checked. The radio button is checked by default.
To specify the number of retries, use the following drop-down list:
— Retries on server overload

Configuration
Select the number here that a retry should be performed if the update
server does not respond due to being overloaded.
You can select up to three retries.
• Use update proxy
If you want to use an update proxy, check this radio button.
From the drop-down list provided here select the connection mode for this
proxy.
The following modes are available:
— none
In this mode, no proxy is used.
— specific
In this mode, one specific proxy is used, which is specified in the input
field next to this drop-down list.
— failover
In this mode, the first of the proxies specified in the input field next to
this drop-down list is also tried first.
If it fails, it will be retried until the configured retry maximum has been
reached. Then the second proxy is tried, and so on.
— round robin
In this mode, the proxy is used that is next to the one that was used
last.
If the last proxy has been reached among those that were specified,
selection of proxies will restart from the beginning.
In the input field next to the drop-down list, enter the proxy or proxies that
should be used for connecting to the update server.
To do this, type a proxy name or select an entry from the drop-down list to the
right. If you want to use more than one proxy, repeat the selection.
The drop-down list should show select one to add as its topmost entry. If
no next hop proxies have been configured yet, the topmost entry reads no
proxies defined.
To configure proxies, click on the button labeled Define Next Hop Proxies.
This will open a window for configuring these proxies.
The window is described in the next subsection.
6–7

Configuration
6–8
Available Proxies
The section in this window allows you to configure next hop proxies for all kinds
of connections. These will then be available for selection on the Use Next Hop
Proxies tab.
After specifying the appropriate settings for a next hop proxy, it is added to the
list of available next proxies by clicking on the Add button.
The list is displayed at the bottom of the section. You can modify the settings
for each proxy that is shown in the list.
Use the following items for configuring available next hop proxies:
• Name
In this input field, enter the name of the next hop proxy you want to configure.
If you leave the field empty, a name will be generated by Webwasher,
e. g. pxy1, and inserted in this field after clicking on the Add button.
The name can be modified after the new proxy has been included in the
list.
• Proxy server address
In the input fields provided here, enter the address of the server you want
to make available as next hop proxy:
— Host
Enter the IP address or URL of this server here.
— Port
Enter the port number of the port for connecting to this server here.
• Proxy authorization
In the input fields provided here, enter the credentials that Webwasher
should use for authentication at the next hop proxy:
— Username
Enter the IP address or URL of this server here.
— Password
Enter the password here.
• Connection behavior
Use the items provided here to configure the connection behavior:
— Retry . . . times on failure for this proxy

Configuration
From the drop-down list provided here, select the number of retries you
want to configure for a next hop proxy. You can configure up to three
retries.
When the maximum number of retries has been reached, Webwasher
will try to establish a connection using another next hop proxy, according
to what has been configured on the Use Next Hop Proxies tab,
e. g. failover or round robin.
— Donotretryproxyfor...minuteswhenithasreached...
times within 10 seconds its maximum number of retries
In the input fields provided here, enter the time information that will
cause a connection break, i. e. an interval during which Webwasher
will not retry a next hop proxy after a connection to it could not be established
in a given situation.
In the first input field, enter the time (in minutes) that the connection
break should last.
In the second input field, specify how often the maximum number of retries
must have been reached within 10 seconds before the connection
break is started.
— use persistent connections
• Add
If you want Webwasher to use persistent connections to the next hop
proxies, make sure this checkbox is marked. The checkbox is marked
by default.
Webwasher will try to meet this requirement by establishing persistent
connections, but may fail to do so in some situations.
You will then see that the failed counter in the list of available next
proxies displays an increased value for the connection to the next hop
proxy in question.
In this case, you might clear the checkbox to disable the option. Note,
however, that this will reduce performance.
After specifying the appropriate information for the server you want to make
available as next hop proxy, click on this button to add it to the list of available
next hop proxies.
The list of available next hop proxies is displayed at the bottom of this section.
For each entry, it provides the information that is specified when a new entry
is added. Furthermore statistical figures are displayed on the reliability of next
hop proxies.
You can edit list entries, delete them and reset the statistics.
6–9

Configuration
6–10
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard. If the number of entries is higher than this number, the
remaining entries are shown on successive pages.
A page indicator is then displayed, where you can select a particular page by
clicking on the appropriate arrow symbols.
To edit an entry, click on the View Details and Edit link in the same line. This
will reopen the window and this section with the information concerning the
next hop proxy in question, so you can modify it.
After completing the modification, click on the Modify button, which is provided
now instead of the Add button, to make it effective. If you want to clear the
information before modifying the settings for a next hop proxy, click on the
Clear Input button.
Apart from the information that was specified when a new entry was added to
the list, such as the proxy name and address, the list displays statistical figures
on the reliability of each next hop proxy.
The following information is provided in the columns of the list:
• reliability
Reliability of a next hop proxy
The reliability is calculated as the percentage of attempts to establish a
connection to the next hop proxy that were successful in relation to the
overall number of attempts.
• tried
Number of times that Webwasher tried to establish a connection to a proxy
• failed
Number of times that an attempt by Webwasher to establish a connection
toaproxyfailed
• last fail
Date and time of the last time that an attempt by Webwasher to establish
a connection to a proxy failed
• do not retry reached
Date and time of the last time that a situation was reached where Webwasher
did not retry a next hop proxy over a given period of time.

Configuration
The length of this period depends on what you configured under Do not
retry proxy for . . . minutes when it has reached . . . times
within 10 seconds its maximum number of retries, see above.
If the do not retry situation is still on, i. e. Webwasher will currently not retry
the next hop proxy in question, the date and time values are displayed in
red.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input fields above the Name, Proxy or Port
columns or in a combination of them and enter this using the Enter key of
your keyboard. The list will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Reset Statistics
Click on this button to reset the statistical figures shown in the list for reliability
of next hop proxies.
• Reset do not retry
Click on this button to reset the statistics only for the do not retry reached
parameter, see above.
To return to the Next Hop Proxies tab, click on the Close button.
The next hop proxy you added to the list, will also appear and be available in
the list of next hop proxies, which is displayed at the bottom of the Use Next
Hop Proxies section on that tab.
6–11

Configuration
6–12
System Notifications
The System Notifications section looks like this:
Using this section, you can configure e-mail notifications to be sent to a recipient’s
e-mail address. There are the following options:
• Send notification upon URL filter database update failure or category
enhancements
Enter the recipient for this notification in the Recipient input field.
• Send notification upon AntiVirus engine and signature update failure
Enter the recipient for this notification in the Recipient input field.
• Send notification upon Anti Spam rule set update failure
Enter the recipient for this notification in the Recipient input field.
Furthermore, you can configure the following options for sending an SNMP
trap:
• Send an SNMP trap if a database update has been successful or
was not required
Clicking on the SNMP trap link will take you to a page where you can
configure the settings for the trap sink, i. e. the SNMP recipient

• Send an SNMP trap if a database update failed
Configuration
Clicking on the SNMP trap link will take you to a page where you can
configure the settings for the trap sink, i. e. the SNMP recipient.
Mark the options for the notifications you want to be sent. Then click on Apply
Changes to make your settings effective.
To configure the settings for the server used to process notifications, click on
the button labeled Edit Notification Mail Server.
This will open a window where you can enter values for these settings.
For a description of this window, see the Notification Settings Window subsection
of 5.5.3.
6–13

Configuration
6.2.2
URL Filter
6–14
The URL Filter tab looks like this:
There are four sections on this tab:
• Current Status
• Log File Contents
• Automatic Update
• Manual Update
They are described in the following.

Current Status
The Current Status section looks like this:
Configuration
This section shows the current status of the URL Filter Database. The following
information is provided:
• Database version
Version of the URL Filter Database
• Status
Status of the URL Filter Database
Prior to the completion of the database update, there may be the following
messages:
— OK
Everything is working.
— Preparing URL lists
Building lists internally.
— Updating URL lists
Incorporating incremental list in order to update.
— Saving list
An internal list was created and is being saved on the hard disk.
— Error during update
In this case, you need to look for a new list, or retry later on.
— Unknown Error
A failure of another type has occurred in one of the above processes.
Upon completion of the database update, there may be the following messages:
— Downloading files
File download is in progress.
6–15

Configuration
6–16
— Server authentication failed
This may be due to a licensing problem.
— Error during file download
An error stopped the files from downloading, retry later on.
• Time of last update
Time when the last update of the URL Filter Database was performed
Log File Contents
The Log File Contents section looks like this:
It displays the last 10 lines of the URL Filter Database update log file.
Automatic Update
The Automatic Update section looks like this:
Using this section, you can configure the time range for an automatic update
of the URL Filter Database.
Mark the checkbox provided here if you want to do this and fill in the input
fields as required. After configuring these settings, click on Apply Changes
to make them effective.

Use the following input fields to configure an automatic update:
• Check and perform updates every ... hours
Configuration
In this input field, enter the number of hours that are to elapse before a new
update is performed.
• If update fails, repeat it after ... minutes.
In this input field, enter the number of minutes for the retry interval.
Manual Update
The Manual Update section looks like this:
This section allows you to perform a manual update of the URL Filter Database.
Use the following items to perform this update:
• Incremental update
Check this radio button to update the incremental lists on demand without
affecting the automatic update settings.
• Full update
Check this radio button to update the entire database from the Internet.
• Local update from ’C:\Programme\Webwasher CSM\conf\smartfilter\’
Check this radio button to manually update lists from another source, e. g.
from a SmartFilter list that is located in a corresponding folder as displayed
here.
For this kind of update, you need to make sure that the list file itself, as well
as a number of other files are stored in this folder.
6–17

Configuration
6–18
You need different kind of files for a full and an incremental update:
— For a full update, you need to store the following files in the SmartFilter
folder:
sfcontrol.download – This file contains the list of for a full update
sfcontrol.download.info – Input in this file is optional. You may
insert text providing information on the update in there.
— For an incremental update, you need to store the following files in the
SmartFilter folder:
sfcontrol.download.info – Input in this file is optional. You may
insert text providing information on the update in there.
sfcontrol.download.current – This file must contain one single
line of text stating the version of the SmartFilter list you want to
update to.
Furthermore, you need to store several incremental update files in this
folder. The name for all of them is sfcontrol.download.,
with varying in the following way: First you need an update
file with a number for the version of the SmartFilter list that is currently
used by Webwasher, but this number increased by one. So if
the current version is, e. g. 1000, you a file named sfcontrol.download.1001.
Then you need a particular number of update files, with the initial number
increased by one until you reach the number of the list version
you want to update to. If you want to update to, e. g. version 1008,
you need to store the update files sfcontrol.download.1001, sfcontrol.download.1002,
and so on, until sfcontrol.download.1008.
The complete list of incremental files would then, e. g. look like this:
• Do It Now
sfcontrol.download.1001
sfcontrol.download.1002
sfcontrol.download.1003
sfcontrol.download.1004
sfcontrol.download.1005
sfcontrol.download.1006
sfcontrol.download.1007
sfcontrol.download.1008
After specifying the appropriate information using the items described
above, click on this button to perform the manual update.

6.2.3
AV Engine
The AV Engine tab looks like this:
There are five sections on this tab:
• Current Status
• Log File Contents
• ISTAG Change
• Automatic Update
• Restart
They are described in the following.
Configuration
6–19

Configuration
6–20
Current Status
The Current Status section looks like this:
This section shows the current status of the anti virus engines and signature
files. The following information is provided:
• Anti Virus Engine
Versions of the anti virus engines that have been configured to run under
Webwasher.
• Update Status
Status of the updates that have been performed for the anti virus engines.
• Time of last update
Time when the last update was performed for an anti virus engine.

Log File Contents
The Log File Contents section looks like this:
It displays the last 10 lines of the anti virus update file.
ISTAG Change
The ISTAG Change section looks like this:
Configuration
It allows you to configure an ISTAG change to be performed after each update,
which will lead to a clearing of the cache content.
The ISTAG version is a kind of version number for an ICAP service. Whenever
this version changes, the ICAP client no longer uses responses previously
given by Webwasher, but asks again for each request and response.
By changing the ISTAG after each update of the signature file, the ICAP client,
e. g. a NetCache client, is told to clear all cached content after the update has
been completed.
If you want to have an ISTAG change performed, make sure the checkbox
provided here is marked. It is marked by default.
6–21

Configuration
6–22
Automatic Update
The Automatic Update section looks like this:
Using this section, you can configure the time range for an automatic update of
the anti virus signature file. Webwasher will check according to the configured
range, whether a new version is available and will download this version if this
is the case.
The usage of the checkbox, input field and button provided here is as follows:
• Check and perform updates every ... minutes
Mark the checkbox provided here if you want to configure an automatic
update. In the input field, enter the number of minutes that are to elapse
before a new update is performed.
• Do It Now
Click on this button to perform the update immediately.
Restart
The Restart section looks like this:
It provides the following button:
• Restart AV Engine
Click on this button to restart the anti virus engine after changing a local
antivirus file.

6.2.4
Spam Filter
The Spam Filter tab looks like this:
There are four sections on this tab:
• Current Status
• Log File Contents
• Automatic Update
• Manual Update
They are described in the following.
Current Status
The Current Status section looks like this:
Configuration
6–23

Configuration
6–24
This section shows the current status of the spam filter database. The following
information is provided:
• Database Version
Version of the database containing the spam filter rules.
• SpamCatcher Engine version
Version of the engine used for spam filtering.
• Status
Status of the updates that have been performed for the spam filter rules.
• Time of last update
Time when the last update was performed for the spam filter rules.
Log File Contents
The Log File Contents section looks like this:
It displays the last 10 lines of the spam filter rules update log file.
Automatic Update
The Automatic Update section looks like this:
Using this section, you can configure the time range for an automatic update
of the spam filter rules.

Configuration
Webwasher will check according to the configured range, whether a new version
is available and will download this version if this is the case.
There is a checkbox provided here, which is labeled:
• Check and perform updates every ... minutes
Mark this checkbox if you want to configure an automatic update. In the
input field, enter the number of minutes that are to elapse before a new
update is performed.
Manual Update
The Manual Update section looks like this:
Using this section, you can perform a manual update of the spam filter rules.
The following buttons are provided in this section:
• Incremental update
Check this radio button to perform an incremental update of the spam filter
rules.
• Full update
Check this radio button to perform a full update of the spam filter rules.
• Local update from ’C:\Programme\Webwasher CSM\conf\spamequator\’
Check this radio button to perform an update using the source specified
here.
• Do It Now
Click on this button to perform the configured update option immediately.
6–25

Configuration
6.2.5
Proactive Scanning
6–26
The Proactive Scanning tab looks like this:
There are five sections on this tab:
• Current Status
• Log File Contents
• ISTAG Change
• Automatic Update
• Manual Update
They are described in the following.

Current Status
The Current Status section looks like this:
Configuration
This section shows the current status of the Proactive Scanning database and
its updates. In this database, a set of detection rules for the mobile code filter is
stored. These rules are applied in order to counteract hitherto unknown mobile
code seeking to exploit vulnerabilities as it emerges.
The following information is provided in this section:
• Version
Version of the Proactive Scanning database.
• Update Status
Status of the updates that have been performed for the Proactive Scanning
database.
• Time of last update
Time when the last update was performed for the Proactive Scanning database.
Log File Contents
The Log File Contents section looks like this:
It displays the last 10 lines of the Proactive Scanning update log file.
6–27

Configuration
6–28
ISTAG Change
The ISTAG Change section looks like this:
It enables you to make sure that cached content on an ICAP client is invalidated
after an update. The ISTAG method is used in ICAP communication to indicate
significant changes.
If you want to have an ISTAG change performed, mark the checkbox provided
here and click on Apply Changes.
Automatic Update
The Automatic Update section looks like this:
Using this section, you can configure the time range for an automatic update
of the Proactive Scanning database. Webwasher will check according to the
configured range, whether a new version is available and will download this
versionifthisisthecase.
Mark the checkbox provided here if you want to configure an automatic update.
The usage of the input field and button below is as follows:
• Check and perform updates every ... minutes
In this input field enter the number of minutes that are to elapse before a
new update is performed.
• Do It Now
Click on this button to perform the update immediately.

6.2.6
CRLs
Manual Update
The Manual Update section looks like this:
Configuration
Using this section, you can perform a manual update of the Proactive Scanning
database.
For this purpose, input fields and a button are provided in this section. Their
usage and meaning are as follows:
• Perform local update to version ... from
In the upper input field after version, enter the version number that you
want to update to. In the lower input field, enter the location of the file you
want to use for the update.
• Do It Now
Click on this button to perform the configured update option immediately.
The CRLs tab looks like this:
6–29

Configuration
6–30
There are three sections on this tab:
• Current Status
• Log File Contents
• Automatic Update
They are described in the following.
Current Status
The Current Status section looks like this:
This section shows the current status of the CRLs (Certificate Revocation Lists)
update. The following information is provided:
• Status
Status of the CRLs updates.
• Time of last update
Time when the last CRLs update was performed.
Log File Contents
The Log File Contents section looks like this:
It displays the last 10 lines of the CRLs update log file.

Automatic Update
The Automatic Update section looks like this:
Configuration
Using this section, you can configure the time range for an automatic CRLs
update. Webwasher will check according to the configured range, whether a
new version is available and will download this version if this is the case.
Mark the checkbox provided here if you want to configure an automatic update.
The usage of the drop-down list and button below is as follows:
• Daily at ... (local system time)
From the drop-down list provided here, select an hour to specify a time for
the daily update.
• Do It Now
Click on this button to perform the update immediately.
6.3
Central Management
The Central Management options are invoked by clicking on the corresponding
button under Configuration:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Node Settings, see 6.3.1
• Master Settings, see 6.3.2
• Site Settings, see 6.3.3
6–31

Configuration
6.3.1
Node Settings
6–32
The Node Settings tab looks like this:
There are three sections on this tab:
• Current Instance Status
• Instance Role
• Proxy Server Options
They are described in the following.
Current Instance Status
The Current Instance Status section looks like this:
In this section, information is displayed about the status of the current instance,
i. e. the Webwasher instance you are presently configuring.
You are told how this instance has been configured and if it has been configured
correctly. The information is displayed with a square in green, yellow or
orange color, and a message text.

Configuration
A green square means that the instance has been configured correctly. A yellow
or orange square means that there is something missing in the configuration,
with the orange color indicating a more serious fault.
Messages that can appear in this section are, e. g.:
• Green square - This Webwasher instance is running as a standalone server
• Green square - 2 site instances are subscribed at this master
• Yellow square - No site instances are subscribed at this master
• Orange square - The master of this site instance has not been configured
or is unreachable
Instance Role
The Instance Role section looks like this:
Using this section, you can configure a role for an instance of Webwasher.
In a group of multiple servers (nodes) running Webwasher (called a "Cluster"),
one Webwasher instance can act as the master instance, which means that
all configuration changes are to be performed on this system. The other Webwasher
instances in this cluster can then be configured as site instances. Since
site instances retrieve their configuration from the master, every configuration
task you perform on the master instance is replicated to all site instances.
In addition to the options of configuring Webwasher as a master or a site instance,
you can configure it to take the role of a sub-master. A sub-master
performs the roles of master and site instance at the same time. So, other site
instances can subcribe themselves at a sub-master like they can at a master.
Optionally, a sub-master can take over the role of the master in case the master
goes offline, and there will be a failover of the Webwasher administration from
the master to the sub-master as soon as this happens.
Furthermore, you can configure Webwasher for running on a standalone
server, i. e. a system that is not participating in a cluster at all.
6–33

Configuration
6–34
Note: You can exclude settings from being transferred from the master to the
site instances, and also protect settings that have been configured on a site
instance against being overwritten by settings transferred from the master. If
settings on a site instance are protected in this way, they can only be changed
on this instance.
The meaning of the options provided in this section is as follows:
• Yes, act as a cluster node of the following role:
Configures this instance of Webwasher for running in a Webwasher cluster.
— Master instance
Configures this instance of Webwasher to run as a master.
Take over sub-master’s configuration in case it has been
changed while this master was offline
Configures the taking over of Webwasher settings from a sub-master.
— Site Instance
Configures this instance of Webwasher to run as a site instance.
— Sub-Master instance (act as both master and site)
Configures this instance of Webwasher to run as a sub-master instance.
Notify the parent master’s site instances whenever its availability
changes
Configures a notification to be sent to the site instances of the master
whose role this sub-master is to take over. The notification will be sent
each time the master goes offline or goes online again.
• No, act as a standalone server
Configures this instance of Webwasher for not running in a Webwasher
cluster.
This is the default option.
Check the options you want to configure for the current Webwasher instance.
Then click on Apply Changes to make your settings effective.

Proxy Server Options
The Proxy Server Options section looks like this:
Configuration
Using this section, you can specify whether a proxy server should be used for
communication between this instance of Webwasher and its master instance
(given it is a site instance), or its site instances (given it is a master instance).
After specifying the appropriate settings click on Apply Changes to make
them effective.
Use the following items to configure a proxy server:
• Do not use a proxy server
No proxy server will be used and the instance will communicate directly
with its master instance or its site instances.
• Use next hop proxies as specified for ...
The server that has been configured as Web proxy will be used as next
hop proxy. This is the default option.
Click on the link provided here to view or change the proxy server that has
been configured so far.
• (For using other next hop proxies)
If you want to use other next hop proxies, check this radio button and configure
them here. To do this, proceed as follows:
From the drop-down list select the connection mode. The following modes
are available:
— none
In this mode, no proxy is used.
— specific
In this mode, one specific proxy is used, which is specified in the input
field next to this drop-down list.
6–35

Configuration
6–36
— failover
In this mode, the first of the proxies specified in the input field next to
this drop-down list is also tried first.
If it fails, it will be retried until the configured retry maximum has been
reached. Then the second proxy is tried, and so on.
— round robin
In this mode, the proxy is used that is next to the one that was used
last.
If the last proxy has been reached among those that were specified,
selection of proxies will restart from the beginning.
In the input field next to the drop-down list, enter the next hop proxy or proxies
that should be used. To do this, type their names or select an entry from the
drop-down list to the right. If you want to use more than one proxy, repeat the
selection.
The drop-down list should show select one to add as its topmost entry. If
no next hop proxies have been configured yet, the topmost entry reads no
proxies defined.
To configure next hop proxies, click on the button labeled Define Next Hop
Proxies. This will open a window for configuring these proxies.
The window is described in the subsection below.
Available Proxies
The section in this window allows you to configure next hop proxies for all kinds
of connections. These will then be available for selection on the Use Next Hop
Proxies tab.
After specifying the appropriate settings for a next hop proxy, it is added to the
list of available next proxies by clicking on the Add button.
The list is displayed at the bottom of the section. You can modify the settings
for each proxy that is shown in the list.
Use the following items for configuring available next hop proxies:
• Name
In this input field, enter the name of the next hop proxy you want to configure.
If you leave the field empty, a name will be generated by Webwasher,
e. g. pxy1, and inserted in this field after clicking on the Add button.

Configuration
The name can be modified after the new proxy has been included in the
list.
• Proxy server address
In the input fields provided here, enter the address of the server you want
to make available as next hop proxy:
— Host
Enter the IP address or URL of this server here.
— Port
Enter the port number of the port for connecting to this server here.
• Proxy authorization
In the input fields provided here, enter the credentials that Webwasher
should use for authentication at the next hop proxy:
— Username
Enter the IP address or URL of this server here.
— Password
Enter the password here.
• Retry . . . times on failure for this proxy
From the drop-down list provided here, select the number of retries you
want to configure for a next hop proxy. You can configure up to three retries.
When the maximum number of retries has been reached, Webwasher
will try to establish a connection using another next hop proxy, according
to what has been configured on the Use Next Hop Proxies tab, e. g.
failover or round robin.
• Do not retry proxy for . . . minutes when it has reached . . .
times within 10 seconds its maximum number of retries
In the input fields provided here, enter the time information that will cause
a connection break, i. e. an interval during which Webwasher will not retry
a next hop proxy after a connection to it could not be established in a given
situation.
In the first input field, enter the time (in minutes) that the connection break
should last.
In the second input field, specify how often the maximum number of retries
must have been reached within 10 seconds before the connection break is
started.
6–37

Configuration
6–38
• Add
After specifying the appropriate information for the server you want to make
available as next hop proxy, click on this button to add it to the list of available
next hop proxies.
The list of available next hop proxies is displayed at the bottom of this section.
For each entry, it provides the information that is specified when a new entry
is added. Furthermore statistical figures are displayed on the reliability of next
hop proxies.
You can edit list entries, delete them and reset the statistics.
To display only a particular number of entries at a time, type this number in the
input field labeled Number of entries per page and enter it using the Enter
key of your keyboard. If the number of entries is higher than this number, the
remaining entries are shown on successive pages. A page indicator is then
displayed, where you can select a particular page by clicking on the appropriate
arrow symbols.
To edit an entry, click on the View Details and Edit link in the same line. This
will reopen the window and this section with the information concerning the
next hop proxy in question, so you can modify it.
After completing the modification, click on the Modify button, which is provided
now instead of the Add button, to make it effective. If you want to clear the
information before modifying the settings for a next hop proxy, click on the
Clear Input button.
Apart from the information that was specified when a new entry was added to
the list, such as the proxy name and address, the list displays statistical figures
on the reliability of each next hop proxy.
The following information is provided in the columns of the list:
• reliability
Reliability of a next hop proxy
The reliability is calculated as the percentage of attempts to establish a
connection to the next hop proxy that were successful in relation to the
overall number of attempts.
• tried
Number of times that Webwasher tried to establish a connection to a proxy
• failed
Number of times that an attempt by Webwasher to establish a connection
toaproxyfailed

• last fail
Configuration
Date and time of the last time that an attempt by Webwasher to establish
a connection to a proxy failed
• do not retry reached
Date and time of the last time that a situation was reached where Webwasher
did not retry a next hop proxy over a given period of time.
The length of this period depends on what you configured under Do not
retry proxy for . . . minutes when it has reached . . . times
within 10 seconds its maximum number of retries, see above.
If the do not retry situation is still on, i. e. Webwasher will currently not retry
the next hop proxy in question, the date and time values are displayed in
red.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input fields above the Name, Proxy or Port
columns or in a combination of them and enter this using the Enter key of
your keyboard. The list will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Reset Statistics
Click on this button to reset the statistical figures shown in the list for reliability
of next hop proxies.
• Reset do not retry
Click on this button to reset the statistics only for the do not retry reached
parameter, see above.
To return to the Next Hop Proxies tab, click on the Close button.
The next hop proxy you added to the list, will also appear and be available in
the list of next hop proxies, which is displayed at the bottom of the Use Next
Hop Proxies section on that tab.
6–39

Configuration
6.3.2
Master Settings
6–40
The Master Settings tab looks like this:
There are three sections on this tab:
• Local Master Settings
• Allow Incompatible Site Versions
• List of Subscribed Sites
They are described in the following.

Local Master Settings
The Local Master Settings section looks like this:
Configuration
Using this section, you can specify the settings that will not be replicated from
the master to the site instances.
When running several instances of Webwasher, you can apply configuration
changes on just one instance, i. e. the master instance, while changes will be
replicated to all the instances that have subscribed to the master instance, i.
e. the site instances.
Whenever you perform an action using the Web interface of the master instance,
a corresponding action is performed on each site instance. Thus all
settings are applied to these instances, unless they are configured to be excluded
from this procedure.
Note that settings related to licensing, the master/site configuration itself, and
Web interface passwords are never replicated to site instances.
Mark the checkboxes for the settings you do not want to be replicated. Then
click on Apply Changes to make this configuration effective.
Allow Incompatible Site Versions
The section labeled Allow Incompatible Site Versions looks like this:
Using this section, you can specify that site instances in a cluster are allowed
to subscribe at the master even if they are running a Webwasher version that is
older or newer than the one running currently on the master, e. g. Webwasher
6.5.0.
6–41

Configuration
6–42
By default, the master does no allow sites that are incompatible in this sense.
The default is set this way because synchronizing the configuration of the master
to that of a site might damage the configuration of this site.
A site is incompatible as soon as the Webwasher version running on it differs
from the master’s version on a major, medium, or minor level. So, a 6.5.1
version would make the site in question incompatible to a master running 6.5.0.
To allow incompatible site versions, mark the checkbox next to the section
heading. Then click on Apply Changes to make this setting effective.
List of Subscribed Sites
The List of Subscribed Sites section looks like this:
This section lists all the site instances that have subscribed to the master instance.
Any changes effected on the master instance will simultaneously be applied to
these instances.
Sites instance will not appear in this list whenever the master is unable to log
on to these sites.

6.3.3
Site Settings
The Site Settings tablookslikethis:
There are four sections on this tab:
• Master Instance Addresses
• Authentication
• Contact Interval
• Local Site Settings
They are described in the following.
Configuration
6–43

Configuration
6–44
Master Instance Addresses
The Master Instance Addresses section looks like this:
In order to obtain settings from the Webwasher master instance for a site instance,
you need to specify the master instance in this section. You can specify
more than one master instance.
The meaning of the input fields and the checkbox provided for this purpose is
as follows:
HTTPS to communicate with this master instance. The following input fields
and buttons are provided in this section:
• Host Names or IPs
Name or IP address of the master instance. More than one instance may
be entered here. The format is:
Host|IP)[,(Host|IP)]*
• Web interface port
Port number of the host that is to be the master instance. The default port
number is 0.
• Use HTTPS to communicate with the master instance
Enable this option if you have configured HTTPS connections to be used
for communication between master and site instances.
After configuring these settings, click on Apply Changes to make them effective.

Authentication
The Authentication section looks like this:
Configuration
Since site instances need to authenticate themselves as admin, whichisthe
administrator account of the master instance when subscribing for change notifications,
the admin password of the master instance must be configured on
the individual site instances as well.
To allow the master instance to log back on to a site instance whenever there
is a configuration activity on the master instance, the admin password of the
site instance is sent to the master instance, along with the subscription. It is
sent in encrypted form, but using HTTPS is also recommended.
Specify a password for the admin accounts on both the master and the site
instance. Then click Apply Changes to make these settings effective.
Contact Interval
The Contact Interval section looks like this:
Using this section, you can configure a time interval for reconnecting to the
master instance, should the master instance be down or unavailable for any
reason.
Furthermore, you can configure a time interval for requesting a configuration
update from the master instance.
6–45

Configuration
6–46
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following input fields to configure these intervals:
• Contact master instance every ... minutes
Enter the time interval (in minutes) here that should elapse before the site
instance contacts the master again.
• Request the whole configuration every ... minutes from master
Enter the time interval (in minutes) here that should elapse before the site
instance requests an update of the configuration settings from the master.
The value that you enter is rounded to achieve a multiple of the value you
entered under Contact master instance every ... minutes.
The minimum value is 30 minutes. Enter 0 to let the site never request a
configuration update from the master.
Local Site Settings
The Local Site Settings section looks like this:
Using this section, you can specify the settings that a site instance should not
retrieve from its master instance.
Note that settings related to licensing, the master/site configuration itself, and
Web interface passwords are never retrieved from the master instance.
Mark the checkboxes for the settings you do not want to be obtained from the
master instance. Then click on Apply Changes to make this configuration
effective.

6.4
Appliance
Configuration
The Appliance options are invoked by clicking on the corresponding button
under Configuration:
Note that these options are only available in an appliance version of Webwasher.
The options are arranged under the following tabs:
They are described in the upcoming sections:
• General, see 6.4.1
• Interfaces, see 6.4.2
• Routes, see 6.4.3
• Time and Date, see 6.4.4
• Reboot/Shutdown, see 6.4.5
• Update, see 6.4.6
• High Availability, see 6.4.7
6–47

Configuration
6.4.1
General
6–48
The General tab looks like this:
There is one section on this tab:
• General
It is described in the following.
General
The General section looks like this:
It allows you to configure some general settings for an appliance.

Configuration
After modifying these settings, you need to commit them and reboot the appliance
in order to make the modification effective.
For this purpose, corresponding buttons are provided on the Commit Settings
tab.
Use the following items to configure the general settings:
• Host Name
Name of a Webwasher appliance
• Default Gateway IP Address
IP address of the network gateway that a Webwasher appliance has been
configured for
• First Name Server
IP address of the first name server that is used by a Webwasher appliance
• Second Name Server
IP address of the second name server that is used by a Webwasher appliance
The second name server will be used as a fallback system in case the first
name server is not available for some reason or other.
6–49

Configuration
6.4.2
Interfaces
6–50
The Interfaces tab looks like this:
There is one section on this tab:
• Network Interfaces
It is described in the following.
Network Interfaces
The Network Interfaces section looks like this:

Configuration
It allows you to configure and activate the network interfaces within your system.
After specifying the appropriate settings for these interfaces, you need to commit
them and reboot the appliance in order to make them effective.
For this purpose, corresponding buttons are provided on the Commit Settings
tab.
Use the following checkboxes and input fields to configure the network interfaces:
• Activate
If you want to activate a particular interface, mark this checkbox in the
corresponding line.
• IP Address
In this input field, enter the IP address for the corresponding interface.
• Network Mask
In this input field, enter the network mask for the corresponding interface.
• Media
If you want to use a media option for a particular interface, enter it in this
field.
You should, however, do this only if you are sure that it will have no unforeseen
impact on your configuration.
The following media types are available as options:
— 100baseT4
— 100baseTx-FD
— 100baseTx-HD
— 10baseT-FD
— 10baseT-HD
• Description
Use this input field to enter a text describing the interface in the same line.
Input in this field is optional.
6–51

Configuration
6.4.3
Routes
6–52
The Routes tab looks like this:
There is one section on this tab:
• Static Routes
It is described in the following.
Static Routes
The Static Routes section looks like this:

Configuration
It allows you to configure static routes for communication towards particular
destinations via a particular gateways and interfaces. After specifying the values
for a new static route, you add it to a list of routes.
If you want to configure a static route as default route, you need to enter the
corresponding gateway address in the Default Gateway IP Address input
field on the General tab.
You should also make sure that you configure static routes only if really needed.
With an incorrectly configured route, it may be impossible to connect to the appliance
over the network. In this case you would have to log in at the appliance
directly in order to correct a configuration error.
After adding a route to the list, you need to commit these settings and reboot
the appliance in order to make the settings effective.
For this purpose, corresponding buttons are provided on the Commit Settings
tab.
Use the following items to configure static routes:
• Destination
In this input field, add the IP address of a destination.
• Gateway
In this input field, add the IP address of the gateway that should be used
to reach the destination.
• Interface
From this drop-down list, select an interface on the gateway that is used to
reach the destination.
• Description
In this input field, you can enter a text describing the static route.
Input in this field is optional.
• Add Route
After specifying the appropriate information in the fields above, click on this
button to add the new static route to the list.
The list is displayed at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
6–53

Configuration
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an entry, type the appropriate text in the input fields of the Destination
Gateway or Description columns or select an interface from the Interface
drop-down list.
Then click on Apply Changes to make these settings effective. You can edit
more than one entry and make the changes effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filtering term in the input field of the Destination column and enter
it using the Enter key of your keyboard. The list will then display only route
entries matching the filter.
• Delete Selected
6.4.4
Time and Date
6–54
Select the route entry you wish to delete by marking the Select checkbox
next to it and click on this button. You can delete more than one entry in
one go.
To delete all entries, mark the Select all checkbox and click on this button.
The Time and Date tab looks like this:

There is one section on this tab:
• Time and Date
It is described in the following.
Time and Date
The Time and Date section looks like this:
Configuration
It allows you to configure the system time for your appliance. You can set a
date, a time and a timezone. Furthermore, you can configure the use of NTP
for determining the system time of your appliance.
The current system time is displayed at the top of this section. By default, the
UTC timezone is used.
After modifying these settings, you need to commit them and reboot the appliance
in order to make the modification effective.
For this purpose, corresponding buttons are provided on the Commit Settings
tab.
Use the following items to configure the system time:
• Set manually
If you want to set the system time of your appliance manually, make sure
the radio button provided here is checked. The radio button is checked by
default.
6–55

Configuration
6–56
Then use the items in this area for a manual setting of date and time:
— New System Date
Select a month, a day, and a year from the drop-down lists provided
here. Then click on the Set button in the same line.
Note that the new system date is then set immediately and no rebooting
of the appliance is required.
— New System Time
Select an hour,, a minute, and a second from the drop-down lists provided
here. Then click on the Set button in the same line.
Note that the new system time is then set immediately and no rebooting
of the appliance is required.
Note that the 24-hours-format is used here (1 p. m. = 13:00).
• Use NTP to synchronize system time
If you want to synchronize the system time of your appliance with NTP
time, check the radio button provided here. Then use the following items
for NTP synchronization:
— Primary NTP
In this input field enter the primary NTP system.
— Secondary NTP
In this input field enter the secondary NTP system.
— Select Timezone
From the drop-down list provided here, select the timezone that should
be valid for the system time of your appliance.
Then click on Apply Changes to make this setting effective. Note that
no rebooting of the appliance is required in this case.

6.4.5
Reboot/Shutdown
The Reboot/Shutdown tablookslikethis:
There is one section on this tab:
• Commit Settings
It is described in the following.
Commit Settings
The Commit Settings section looks like this:
Configuration
It allows you to reboot or shutdown an appliance. If an appliance is running in
a cluster of Webwasher appliances, you can perform a reboot or shutdown for
all cluster members.
Performing a reboot will also make the settings effective that you have configured
prior to this reboot. The same will happen when you shutdown the
appliance.
Use the following buttons to perform these activities:
6–57

Configuration
6.4.6
Update
6–58
• Reboot
Click on this button to reboot an appliance.
The appliance will then go into the munix mode to apply the settings to
the system and to reinitialize the RSBAC settings.
Mark the Send to cluster checkbox before clicking on this button if you
want to reboot all Webwasher appliances in a cluster.
• Shutdown
Click on this button to shutdown an appliance.
Mark the Send to cluster checkbox before clicking on this button if you
want to shutdown all Webwasher appliances in a cluster.
The Update tab looks like this:
There are three sections on this tab:
• Status
• Check for Updates
• Update Log
They are described in the following.

Status
The Status section looks like this:
Configuration
It displays information on the status of the appliance, including the update status.
The following display fields are provided in this section:
• Appliance Version
Current version of an appliance
• Update Status
Status of the update activities for an appliance
Check for Updates
The Check for Updates section looks like this:
It allows you to contact the update server and view the new software versions
that are currently available.
Webwasher provides an update server with a directory structure enabling an
appliance to scan for available updates. To connect to this server, the following
path may be used:
https://appliance.webwasher.com/update
To view new software versions on this server, click on the Contact button:
If no new versions are available, it means that no update is needed for the
appliance. In other words, the appliance is up to date.
6–59

Configuration
6–60
A corresponding message is then displayed in the Status section on the upper
part of the tab:
If the search results in finding new versions, these will be shown in the Update
Search Results section, which is then displayed on the tab:
The results are listed in the following field:
• Appliance Change Log
The field lists the search results for new versions of software packages that
are part of the appliance software, e. g. kernel.
For each new version of a software package, the features and fixes are
listed that are new in this package compared to the version of the package
currently installed on the appliance.
If a new version of the Webwasher application software was found, its new
features and fixes are shown together with the information on other packages.
If the search for new software versions shows that there are actually such versions,
you can download and install them.

Configuration
For this purpose, the Update Appliance section is then displayed on the tab,
providing a button labeled Download and Install:
To download and install the new versions, click on this button.
If the appliance is running in a cluster Webwasher appliance, you can install
the new versions on all cluster members.
To do this, mark the checkbox labeled Send to cluster before clicking on the
button.
The new versions will be installed on all members of the cluster. If a new
version of a software package already exists on a cluster member, however,
no update will be performed for this package.
After clicking on the button, the Downloading New Version section is displayed
on the tab:
It informs you about the status of the download process.
After this process is completed, the appliance reboots itself. With this reboot,
the new software versions are installed on the appliance.
Any update activities that were performed in this way are logged and displayed
in the Update Log section at the bottom of the tab.
6–61

Configuration
Update Log
The Update Log section looks like this:
It displays the last ten line of the appliance update log file. This file records
any update activities that were performed for an appliance.
6.4.7
High Availability
6–62
The High Availability tab looks like this:
There are three sections on this tab:
• Cluster Status
• Heartbeat
• Cluster IP

They are described in the following.
Configuration
Furthermore, there is a subsection describing the removal of a node when
there is another node with the same name in the high-availability cluster:
• Removing a Stale Node From the Cluster Information Database
This subsection follows the one on the Heartbeat feature.
Another subsection provides a sample procedure for setting up a high-availability
cluster for two instances of Webwasher:
• Configuring Two Nodes in a High-Availability Cluster
It follows the Cluster IP subsection.
Cluster Status
The Cluster Status section looks like this:
This section displays the status of the high-availability cluster that the Webwasher
appliance you are presently configuring belongs to.
Status information is provided on:
• The number of nodes in the high-availability cluster that are currently online
• The number of resources that have been configured for the high-availability
cluster
Heartbeat
The Heartbeat section looks like this:
6–63

Configuration
6–64
Using this section, you can configure the settings of the Heartbeat daemon.
This daemon is the core of the high-availability solution that can be run in a
cluster of Webwasher instances running on multiple appliances.
A cluster like this is here referred to as high-availability cluster.
The settings include the interface on the appliance in question that is used for
sending and receiving heartbeat messages, as well as the authentication key
that is required for an incoming heartbeat message in order to be accepted.
Furthermore, you can configure that the Heartbeat daemon is started whenever
the appliance is booted.
The Heartbeat daemon uses information from a database of its own, which
is the Cluster Information Database (CIB). This database is replicated across
all nodes in the high-availability cluster, and changes in the information stored
there are distributed by the Heartbeat program to all nodes.
In order to retrieve information from this database, the cibadmin -Q -o resources,
cibadmin -Q -o nodes, and cibadmin -Q -o constraints commands
can be used.
Another task you need to complete in order to achieve high-availability for a
cluster of Webwasher instances, is to set up a cluster IP address for all nodes
of the high-availability cluster. This is done in the Cluster IP section.
Note that you can use one network interface for running the Heartbeat system
and another one for managing the cluster IP address.
The online help page for the Cluster IP section provides information on the
settings of the cluster IP address, as well as more information on the highavailability
cluster in general.
You also need to configure the use of a time server since time must be synchronized
for each cluster node. It is recommended to configure a server outside
the cluster for this purpose.
The Use NTP to synchronize system time feature on the Time and Date
tab may be used here.
Note, furthermore, that all nodes participating in the Heartbeat system must be
connected to the same network (broadcast domain), and that the node names
must be unique.
There may be a situation, e. g. after re-installation of a node, where two nodes
with the same name exist in high-availability cluster. Each node still has its own
IP address then, but one of them is offline all the time.
You should remove this "stale" node in order to retain a consistent structure for
your high-availability cluster. How to do this is described in the next subsection.

Configuration
After modifying the default settings configured in this section, you need to
reboot the appliance to make the modification effective. A link to the Reboot/Shutdown
tab is provided at the bottom of the section.
If you have configured central management for the cluster that the appliance is
a member of, the settings are transferred to all other appliances in the cluster
after the reboot and replicated there.
For configuring central management, use the tabs provided under Configuration
> Central Management.
Use the following items to configure the Heartbeat daemon:
• Start on Boot
Mark this checkbox to have the Heartbeat daemon started whenever the
appliance is booted.
• Heartbeat Interface
In this input field enter the interface on the appliance that should be used
for sending and receiving heartbeat messages.
• Authentication Key
In this input field enter the authentication key that is required for an incoming
heartbeat message in order to be accepted on the appliance.
Removing a Stale Node From the Cluster Information Database
In a high-availability cluster, there may be two nodes with the same names,
e. g. after re-installation of a node.
Each of these nodes has its own IP address, but one of them is offline all the
time. The Cluster Information Database (CIB) has entries for both nodes.
To remove the "stale" node, you need to delete the corresponding entry in the
database. Proceed as follows:
1. Shutdown the entire high-availability cluster, using the following command:
/etc/init.d/heartbeat stop
2. Remove the host cache file on each node:
rm /var/lib/heartbeat/hostcache
3. Restart the high-availability cluster:
/etc/init.d/heartbeat start
6–65

Configuration
6–66
4. Delete the entry for the stale node:
cibadmin --cib_delete --obj_type nodes --crm_xml ’’
where is the id of the node that should be removed.
Cluster IP
The Cluster IP section looks like this:
Using this section, you can set up an IP address that is valid for multiple nodes
in a high-availability cluster of Webwasher appliances, configure its settings,
enable or disable it, and suspend or resume individual nodes.
The settings include the interface on the appliance where the IP address is
configured, as well as the maximum number of nodes it can be used for.
Furthermore, you can configure a hash algorithm for determining the node that
will be the recipient of a given ICMP/TCP/UDP packet with the cluster IP address
as its destination. This is required since this address is valid for all nodes
in the high-availability cluster.
The hash will make use of information contained in the packet, such as its
source IP address or source port. You can configure which of these two options
should be used for the hash.
Configuring the source IP address ensures that the same Webwasher proxy is
always used for a packet with a given source IP address.
Note, however, that this method may cause difficulties when several clients are
"hidden" behind one NAT box or proxy with a single source IP address.
In a NAT environment, using the source IP address plus the source port for the
hash seems to be an adequate solution to avoid ambiguities.
The disadvantage of this method is that it breaks up the processing of progress
pages and quota management, and possibly other functions. So it should not
be used unless the technical limitations caused by it are sufficiently clear.

Configuration
Load sharing is achieved through an iptables module that uses the hash algorithm
to determine whether a given node should process a packet or not. For
this purpose, the algorithm divides the traffic into portions known as "buckets".
The buckets that a given node is responsible for can be looked up in the
/proc/net/ipt_CLUSTERIP/
Failover is also ensured since in case a node fails, the buckets that this node
was responsible for are migrated to other nodes. Active connection to the
failing node will then break down, of course, and the failing node is taken out
of the high-availability cluster.
The failover can also be performed manually, using the cgctl clusterip --suspend
command on the node in question, which suspends the cluster IP address
for it. The cgctl clusterip --resume command can then be used to
re-enable the cluster IP address.
The same functions can be executed using the Suspend and Resume buttons
in this section, see further below.
After enabling them, the specified settings are made effective for the Heartbeat
daemon that is running on the appliance you are presently configuring.
This daemon must be configured and activated prior to the cluster IP address.
It transfers these settings after enabling to all other appliances in the highavailability
cluster and replicates them there.
The cluster IP address is thus configured for all nodes of the high-availability
cluster, which means it needs to be set up only on one node in order to become
valid also on the other nodes.
To view the address, use the ip addr show command.
Note that configuring a cluster IP address in the way described here is an easy
way to implement load sharing and failover in a small installation.
The number of nodes that is incorporated in this solution should not be higher
than 10, though. Otherwise the administrative overhead caused by implementing
this solution will impede the smooth operation of the high-availability cluster.
For medium and large installations, it is therefore recommended that you use
a dedicated hardware solution to implement load sharing and failover facilities.
When implementing the cluster IP address, you should bear in mind that traffic
for this address will arrive at all nodes of the high-availability cluster, which
means that the bandwidth of the smallest node limits the amount of traffic that
can be processed.
Also with this solution, Webwasher can only be configured to run as proxy,
while it is not possible to configure it as ICAP server, or to use the WCCP
protocol, or to set up transparent authentication via the cluster IP address.
6–67

Configuration
6–68
For troubleshooting a high-availability cluster, the crm_mon command may
be used, as well as several commands for administering the Cluster Information
Database (CIB), which is maintained by the Heartbeat daemon, see the
corresponding online help page.
Furthermore, a sample procedure for configuring two Webwasher instances to
run as nodes in a high-availability cluster is described in the next subsection.
Use the following items to configure the cluster IP address in a high-availability
cluster:
• Cluster IP
In this input field enter the IP address.
• Cluster IP Interface
In this input field enter the interface on an appliance that the cluster IP
address is assigned to.
Remember that this interface will be the same for all nodes of the highavailability
cluster.
• Hash Algorithm
From the drop-down list provided here, select a hash algorithm for determining
the node that will be the recipient of a packet with the cluster IP
address as its destination.
There are two algorithms available, differing with regard to the type of
packet information they use for the hash.
On the limitations that exist for both types, see the information provided
further above.
The following can be configured here:
— sourceip
The IP address of the packet source is used for computing the hash
that determines the recipient node.
— sourceip-sourceport
The IP address and port number of the packet source is used for computing
the hash that determines the recipient node.
• Maximum Nodes
In this input field enter the maximum number of nodes that will be included
in the high-availability cluster, using this cluster IP address.

• Enable Cluster IP
Configuration
After specifying the appropriate information, click on the Enable button
provided here to make the cluster IP address and its settings effective.
• Disable Cluster IP
Click on the Disable button provided here to disable a cluster IP address.
• Suspend Current Node
Click on this button to suspend the current node from being a member of
the high-availability cluster.
• Resume Current Node
Click on this button to resume membership in the high-availability cluster
for the current node.
Configuring Two Nodes in a High-Availability Cluster
The following sample procedure describes how to configure two instances of
Webwasher running on different appliances to run as nodes in a high-availability
cluster.
It is recommended to join the two instances in a small central management
cluster before configuring the high-availability settings. This means that one of
the instances is configured as master and the other as site instance.
The high-availability settings are then configured only on the master instance,
from where they are distributed to the site instance.
An alternative way of configuring high-availability for two instances of Webwasher
would be to join them to an existing central management cluster before
configuring the high-availability settings.
In this case, you would have to configure both instances as site instances of
the existing master instance and then configure the high-availability settings
on that master instance.
To configure two nodes in a newly created high-availability cluster, proceed as
follows:
1. Login to the Webwasher instance on the first appliance, and in the Web
interface of that instance go to the Node Settings tab under Configuration
> Central Management.
2. In the Instance Role section on that tab, check the radio button labeled
Yes, act as a cluster node of the following role, and then the Master
instance radio button.
6–69

Configuration
6–70
3. Click on Apply Changes to make these settings effective.
Leave the other settings that can be configured for a master instance on
the Master Settings tab at their default values, or modify them according
to your requirements.
For more information on these settings, see the corresponding online help
pages.
4. Login to the Webwasher instance on the second appliance, and in the
Web interface of that instance go to the Site Settings tab under Configuration
> Central Management.
5. On this tab, configure the following settings:
• In the Host Names or IPs input field of the Master Instances Addresses
section, type the host name or IP address of the master instance.
• In the Web Interface Port input field, type the port number of the
port that should be used for communication between the master and
the site instance.
• In the Password input fields of the Authentication section, type a
password to allow the site instance to login to the Web interface of the
master instance and another to allow the master to login on the site
instance.
Retype both passwords.
• IntheContact Interval section, type 30 as value of the time interval
(in minutes) for requesting synchronization from the master. This is
the minimum interval, you may also configure a higher value here.
6. Click on Apply Changes to make these settings effective.
Leave the other settings on this tab at their default values, or modify them
according to your requirements. For more information on these settings,
see the corresponding online help pages.
7. In the Web interface of the instance you configured as master, go the
High-Availability tab under Configuration > Appliance, and configure
the following settings in the Heartbeat section of that tab:
• Mark the Start on Boot checkbox to have the Heartbeat daemon
started whenever the appliance is booted.
• IntheHeartbeat interface input field, type the name of the interface
on the appliance that should be used for sending and receiving heartbeat
messages, e. g. eth0.
• In the Authentication Key input field, type the key that is required
for an incoming heartbeat message in order to be accepted on the
appliance, e. g. SuperSecretKeyZZZ.
For more information on these settings, see the corresponding online help
pages.

Configuration
8. Reboot the appliance that this instance of Webwasher is running on to
make the Heartbeat settings effective.
You may use the Reboot button on the Reboot/Shutdown tabtodo
this.
9. In the Cluster IP section, configure the following settings, see the explanations
given above for more information on them:
• In the Cluster IP input field, type the cluster IP address for the highavailability
cluster, e. g. 10.150.34.103.
• In the Cluster IP interface input field, type the name of the interface
on the appliance that the cluster IP address is assigned to, e. g. eth0.
• From the Hash Algorithm drop-down list, select either the sourceip
or the sourceip-sourceport algorithm for determining the node that
will be the recipient of a packet with the cluster IP address as its destination.
• In the Maximum Nodes input field, type the maximum number of
nodes to be included in the high-availability cluster that uses this cluster
IP address, e. g. 2.
10. Click on the Enable button to make the cluster IP address and its settings
effective.
This completes the sample configuration procedure.
After the contact interval that you configured has elapsed, the high-availability
settings should be distributed from the master to the site instance and the highavailability
cluster should be working.
You should then be able to ping both nodes of the high-availability cluster using
the cluster IP address.
6.5
Web Interfaces
The Web Interfaces options are invoked by clicking on the corresponding
button under Configuration:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Ports, see 6.5.1
6–71

Configuration
6.5.1
Ports
6–72
• Sessions, see 6.5.2
• Dashboard / Quick Snapshots, see 6.5.3
The Ports tab looks like this:
There are four sections on this tab:
• Web Interface Port Settings (HTTP)
• Web Interface Port Settings (HTTPS)
• EndUserPortSettings
• Web Interface Options
They are described in the following.

Web Interface Port Settings (HTTP)
Configuration
The Web Interface Port Settings section for HTTP connections looks like
this:
Using this section, you can configure the Web interface port for HTTP connections.
If you want to use this feature, make sure the checkbox next to the section
heading is marked. The checkbox is marked by default.
After modifying this setting or any other setting in this section, click on Apply
Changes to make the modification effective.
Use the following input fields to configure these port settings:
• Port
Enter the port number of the listener port here, e. g. 9999.
In addition to a port number, you can also enter the IP address of the interface
you want to configure this port for, which means you could enter
e. g. 10.150.34.33:9999.
The default port number is 9090.
If you also enter an IP address, it is checked whether this address is valid,
i. e. whether it is an IP address of a network interface that is known within
your local system. If the address is invalid, a message is displayed to
inform you about it. The port number you entered will not be processed in
this case, and the existing port number will remain in use.
So, to change a port number using this field you need to either enter a valid
IP address with the port number or the port number without an IP address.
A redirect will then be performed in order to use the port number you just
configured for access to the Web interface. This redirect will, however, only
be performed if you are actually using an HTTP connection to access the
Web interface.
6–73

Configuration
6–74
Note also that when a port number is transferred in a cluster to synchronize
the master’s settings with those of the site instances, only the port number
itself is transferred, which means that if an IP address was also specified,
it is ignored in the synchronization process.
If you want to exclude port numbers from being transferred in this process,
enable the Listener Ports option in the Local Site Settings section on
the Site Settings tab under Configuration > Central Management to
forbid synchronization of port numbers on a site instance.
Enable the same option in the Local Master Settings section on the Master
Settings tab to forbid it for port numbers on a master instance.
• Allow access from
Use this field to configure the IP addresses that should have access to
each port that is opened by Webwasher.
The input format is:
(IP|IP/NetMask|IPrange)[,(IP|IP/NetMask|IPrange)]*
An asterisk (*) means that everyone is allowed access.
If this the same port is specified here as for the HTTP proxy, this setting
will be ignored.
Web Interface Port Settings (HTTPS)
The Web Interface Port Settings section for HTTPS connections looks like
this:
Using this section, you can configure the Web interface port for HTTPS connections.
If you want to use this feature, make sure the checkbox next to the section
heading is marked. The checkbox is marked by default.
After modifying this setting or any other setting in this section, click on Apply
Changes to make the modification effective.

Use the following input fields to configure these port settings:
• Port
Enter the port number of the listener port here. e. g. 9999.
Configuration
In addition to a port number, you can also enter the IP address of the interface
you want to configure this port for, which means you could enter
e. g. 10.150.34.33:9999.
The default port number is 9091.
If you also enter an IP address, it is checked whether this address is valid,
i. e. whether it is an IP address of a network interface that is known within
your local system. If the address is invalid, a message is displayed to
inform you about it. The port number you entered will not be processed in
this case, and the existing port number will remain in use.
So, to change a port number using this field you need to either enter a valid
IP address with the port number or the port number without an IP address.
A redirect will then be performed in order to use the port number you just
configured for access to the Web interface. This redirect will, however, only
be performed if you are actually using an HTTPS connection to access the
Web interface.
Note also that when a port number is transferred in a cluster to synchronize
the master’s settings with those of the site instances, only the port number
itself is transferred, which means that if an IP address was also specified,
it is ignored in the synchronization process.
If you want to exclude port numbers from being transferred in this process,
enable the Listener Ports option in the Local Site Settings section on
the Site Settings tab under Configuration > Central Management to
forbid synchronization of port numbers on a site instance.
Enable the same option in the Local Master Settings section on the Master
Settings tab to forbid it for port numbers on a master instance.
• Allow access from
Use this field to configure the IP addresses that should have access to
each port that is opened by Webwasher.
The input format is:
(IP|IP/NetMask|IPrange)[,(IP|IP/NetMask|IPrange)]*
An asterisk (*) means that everyone is allowed access.
6–75

Configuration
6–76
End User Port Settings
The End User Port Settings section looks like this:
Using this section, you can configure an internal port that is available for end
users who want to access Webwasher. This can be either the Web interface
port, i. e. the port also used by administrators, or an additional port that you
specify here.
Furthermore, you can specify that HTTPS connections must be used for access
to Webwasher.
The internal port will be available for end users accessing Webwasher in order
to, e. g. change their passwords, handle e-mail digests or edit the e-mail white
list.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Using this section, you can configure options for using the Web interface.
You can enforce the use of basic authentication as a method for access and
specify a login window name that should be used for this purpose.
Note that it does not make sense to configure a session length when basic
authentication is enforced here. Even if your session times out, you will be
automatically authenticated at the next request.
For this reason, there is also no logout link provided at the top of the Web
interface area when basis authentication is enforced.
After specifying the appropriate settings, click on Apply Changes to make
them effective.

Configuration
Use the following items to configure an internal port for access to Webwasher:
• Use Webinterface Port
If you want to enforce basic authentication for access to the Web interface,
mark this checkbox.
If the Web interface port should be used, make sure this radio button is
checked.
The radio button is checked by default.
• Use Additional Port
If you want to use an additional port, check this radio button. Then specify
the port settings using the following input fields:
— Port
Specify the additional port here. The input format is:
[IP]: port
The default port number is 9093.
— Allow access from
Specify the range of IP addresses that should have access to Webwasher
here. The input format is:
(IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]|*
Note: Type * to allow everyone access.
• use HTTPS connections
If HTTPS connections should be required for access to Webwasher, make
sure this checkbox is marked.
The checkbox is marked by default.
6–77

Configuration
6–78
Web Interface Options
The Web Interface Options section looks like this:
Using this section, you can configure options for using the Web interface.
You can enforce the use of basic authentication as a method for access and
specify a login window name that should be used for this purpose.
Note that it does not make sense to configure a session length when basic
authentication is enforced here. Even if your session times out, you will be
automatically authenticated at the next request.
For this reason, there is also no logout link provided at the top of the Web
interface area when basis authentication is enforced.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following checkbox and input field to configure these options:
• Force usage of Basic authentication
If you want to enforce basic authentication for access to the Web interface,
mark this checkbox.
• Login window name
Enter the name of the login window here. The default name is Webwasher
configuration.
After specifying values for these settings, click on Apply Changes to make
them effective.

6.5.2
Sessions
The Sessions tab looks like this:
There are two sections on this tab:
• Session Options
• Session Overview
They are described in the following.
Session Options
The Session Options section looks like this:
Configuration
Using this section, you can configure the length of a Webwasher session.
This will apply to a session of the Web interface, as well as to one of the SSH
interface.
After specifying this setting, click on Apply Changes to make it effective.
6–79

Configuration
6–80
Use the following input field to configure the session length:
• Session length ... minutes
Enter a time interval (in minutes) for the session length here.
Session Overview
The Session Overview section looks like this:
This section displays all Webwasher sessions that are currently active. For
each session the following information is provided:
• User
User name of the user who is logged in for the session.
• TTL
Time that the session has lasted so far (in minutes and seconds).
• Status
Status the user of a session has with regard to session mode and access
privileges.
• Interface
Protocol used for the session.
• from IP
IP address that the user has logged in from to the session.

6.5.3
Dashboard / Quick Snapshots
The Dashboard / Quick Snapshots tab looks like this:
There are two sections on this tab:
• Enable/Disable
• Frequent Media Types Counter
They are described in the following.
Enable/Disable
The Enable/Disable section looks like this:
Configuration
6–81

Configuration
6–82
Using this section, you can configure the display of the dashboard and the
various quick snapshots.
By default, display is enabled for all of these features. To disable or re-enable
display for a feature, clear or mark the corresponding checkbox.
After modifying any of these settings, click on Apply Changes to make the
modification effective.
Display of the following features can be configured here:
• Dashboard
• Common Quick Snapshot
• URL Filter Quick Snapshot
• Anti-Malware Quick Snapshot
• Anti-Spam Quick Snapshot
• SSL Scanner Quick Snapshot
Frequent Media Types Counter
The Frequent Media Types Counter section looks like this:
Usig this section, you can reset the counter that counts frequent media types
processed by the Webwasher filters, i. e. set it to zero.
Media types are counted by hits and by volumes. The results of this counter
are displayed in the Frequent Media Types by Hits and Frequent Media
Types by Volumes sections on the Quick Snapshot tab under Common >
Quick Snapshot.
Use the following button to reset the counter:
• Reset Frequent Media Types Counter
Click on this button to reset the counter.

6.6
Secure Administration Shell
Configuration
The Secure Administration Shell options are invoked by clicking on the
corresponding button under Configuration:
If you want to enable any of these options, you also need to mark the checkbox
that is on this button.
Then click on Apply Changes to make this setting effective.
The options are arranged under the following tab:
They are described in the upcoming section:
• General Settings, see 6.6.1
6–83

Configuration
6.6.1
General Settings
6–84
The General Settings tab looks like this:
There are four sections on this tab:
• Port Settings
• Server Host Keys
• Authentication
• Protocol Options
They are described in the following.

Port Settings
The Port Settings section looks like this:
Configuration
Using this section, you can configure the listener port for the administration
shell server. For security reasons, you can also restrict access to this port to
particular IP addresses.
After specifying the appropriate settings, click on Apply Changes to make them
effective.
Use the following input fields to configure these port settings:
• Port
Enter the port number of the listener port for the administration shell server
here. The default port number is 9092.
The input format is:
[IP:] Port
• Allow access from
Enter the IP addresses that should have access to each port opened by
Webwasher here.
The input format is:
(IP|IP/NetMask|IPrange)[,(IP|IP/NetMask|IPrange)]*
Entering an * here means that everyone is allowed access.
6–85

Configuration
6–86
Server Host Keys
The Server Host Keys section looks like this:
Using this section, you can generate the server host key that is needed for
identification of the administration shell server. This key is also known as public
key. It is one of a pair of keys, where the other key is a private key that no one
has access to.
Clients having a copy of this public key can verify whether the server also owns
the corresponding private key, and thereby verify the identity of the server.
The public key and the private key are both encryption keys, with the private
key allowing both encryption and creation of digital signatures. A private key
on a client is only known to the corresponding user. This ensures trustworthy
identification of the server as well as confidentiality of data and digital signatures.
Public and private keys can make use of the RSA (Rivest Shamir Adleman) or
DSA (Digital Signature Algorithm) cryptosystems, on which the Diffie-Hellmann
key type exchange method is applied. With RSA encryption, you need not type
a password when connecting to other hosts on the network that recognize your
public key.
The meaning of the items provided in this section is as follows:
• RSA/DSA Key Type
Use this key type list to select either the RSA or the DSA key type and
generate the corresponding keys by clicking on the Generate button at
the right end of the line in question.
A fingerprint and the bit strength can also be displayed for these keys.

Configuration
You can also import a private key. To do this, use the following items in the
lower part of the section:
• Key type
Select the type (RSA or DSA) of the private key from the drop-down list
provided here.
• File
Use the Browse button next to this input field to browse for the file containing
the private key.
• Passphrase
In this input field, enter a passphrase for the private key.
Note that the security of your passphrase is extremely important as it it
used to authenticate you to any server you wish to connect to. Be aware
of any unencrypted network connections. Should someone figure out this
passphrase, this person would have access to all the servers you are using.
Passphrases should be between 25 and 80 characters, and can consist of
multiple words (spaces are acceptable) as well as digits, and should not
be something obvious, such as the name of a person, a place name, etc.
• Import
After specifying input for the above fields, click on this button to import the
private key.
Authentication
The Authentication section looks like this:
It allows you to configure authentication methods for administrators with regard
to using logon credentials and public keys.
To configure credentials and keys that can be used here, click on the Administrators
link provided in this section. This will take you to the Accounts tab
under User Management > Administrators.
After modifying any of these settings here, click on Apply Changes to make
the modification effective.
6–87

Configuration
6–88
Use the following checkboxes to configure authentication methods:
• Password authentication with web interface logon credentials
If you want administrators to authenticate themselves by submitting logon
credentials for access to the Web interface including a password, make
sure this checkbox is marked.
The checkbox is marked by default.
• Public key authentication
If you want administrators to authenticate themselves using a public key,
make sure this checkbox is marked.
The checkbox is marked by default.
Protocol Options
The Protocol Options section looks like this:
Using this section, you can specify methods for negotiations between the administration
shell server and its clients. The methods will be applied in the
order they have been entered in the input fields provided here.
To disable a method delete it from the corresponding input field.
After doing this or specifying any other information, click on Apply Changes
to make these settings effective.
Use the following input fields to configure protocol options:
• Session encryption ciphers
Ciphers are message formats that render communication unreadable except
to the intended recipient, e. g. DES (Data Encryption Standard), AES
(Advanced Encryption Standard), Blowfish, etc.

The input format is:
Method [, Method]*
• Message authentication algorithms
The algorithms used for authenticating messages.
The input format is:
Method [, Method]*
• Key-exchange methods
Configuration
Includes means for securely distributing encryption keys to all parties involved,
e. g. Diffie-Hellmann algorithm.
The input format is:
Method [, Method]
• Compression
Methods of reducing the size of a given file to something more manageable.
The input format is:
6.7
SNMP Interface
Method | none) [, (Method | none)]
The SNMP Interface options are invoked by clicking on the corresponding
button under Configuration:
If you want to enable any of these options, you also need to mark the checkbox
that is on this button.
Then click on Apply Changes to make this setting effective.
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Agent, see 6.7.1
6–89

Configuration
6.7.1
Agent
6–90
• Communities, see 6.7.2
• SNMPv3 Users, see 6.7.3
• Trap Sinks, see 6.7.4
• MIB Browser, see 6.7.5
The Agent tab looks like this:
There are three sections on this tab:
• Port Settings
• System Information
• Protocol Options
They are described in the following.

Port Settings
The Port Settings section looks like this:
Configuration
Using this section, you can configure the transport protocol and the listener
port to be used for the SNMP Agent.
The transport protocol is either UDP or TCP. While SNMP agents naturally run
on port 161, Webwasher uses port 9161 to allow it to run side-by-side with an
existing SNMP agent (of the operating system).
When running on a UNIX operating system, changing the port to 161 or anything
below 1024 will require a restart of Webwasher.
The following options are provided in this section:
• UDP Port
Make sure this option (default) is enabled if you want to use UDP as transport
protocol for the SNMP Agent.
Enter a port number in the corresponding input field if you do not want to
use 9161 (default) as the listener port. The format for specifying a port is:
[IP:] Port
• TCP Port
Enable this option if you want to use TCP as transport protocol for the
SNMP Agent.
Enter a port number in the corresponding input field if you do not want to
use 9161 (default) as the listener port. The format for specifying a port is:
[IP:] Port
• Allow access from
In this input field, enter the IP addresses of the sites you allow to have
access to each port opened by Webwasher. The format for specifying IP
addresses is:
6–91

Configuration
6–92
IP | IP/NetMask | IP range) [,(IP | IP/NetMask | IP range)]*
The default is an asterisk * , which means to allow access to all sites.
System Information
The System Information section looks like this:
Using this section, you can specify information on the Webwasher software
you are currently configuring for use with the SNMP Agent.
The following inout fields are provided here for specifying information:
• Description
Description of the Webwasher software.
Here you can, e. g., state the release of this software or the purpose it is
used for on the corresponding system.
• Object ID
Numerical system description of the Webwasher software.
This is the description used by the MIB (Management Information Base)
system. Within this system, a numerical description is assigned as an ID
to each of the objects administered by the system. A short form for Object
ID is: OID.
The objects can also be displayed in a MIB tree, see 6.7.5.
Example of an Object ID (OID): 1.3.6.1.4.1.1457.2.1.1.1.13
This is the Object ID of a particular version of the Webwasher software.
• Contact Person
E-mail address of the administrator responsible for maintaining the Webwasher
software.

• Physical location
Configuration
Physical location of the system the Webwasher software is running on.
Here you can enter information specifying a room or a floor in a building
like, e. g. , Delta Building, 1st floor.
Protocol Options
The Protocol Options section looks like this:
It allows you to configure the version of the SNMP protocol to be used for
communication with the SNMP Agent
Specifying more than one version here will enable simultaneous use of the
features provided by each of them.
The following protocol options can be configured:
• Allow SNMP protocol version 1
This option is enabled by default.
• Allow SNMP protocol version 2c
This option is enabled by default.
• Allow SNMP protocol version 3
This version of the SNMP protocol provides a number of new security features,
introducing a comprehensive approach to security issues known as
the User-Based Security Model (USM).
This option is disabled by default. For this reason, access from an SNMPv3
user account is not possible during the setup phase of the SNMP Agent.
6–93

Configuration
6.7.2
Communities
6–94
The Communities tab looks like this:
There are two sections on this tab:
• Communities
• Client Lockout
They are described in the following.

Communities
The Communities section looks like this:
Configuration
Using this section, you can configure the communities that are allowed access
to the SNMP Agent.
In terms of SNMP communication, a community is a particular host system or
group of systems that is allowed access to the SNMP Agent and to the objects
managed by this agent. Communities are specified through their Internet addresses
or host names.
Access is allowed either as read-only access (public mode) or as unrestricted
access (private mode). Accordingly, passwords are configured for communities,
which are either private or public and are termed “community strings”.
To add a community to the list, use the area labeled:
• Add community
Specify the appropriate information using the following items:
— Community String
Enter a community string (password) for the community you are
presently configuring in this input field.
6–95

Configuration
6–96
— Allowed from
Specify the community you want to allow access to the SNMP Agent in
this input field.
This is done by entering a host name or an IP address or any other of
the values of the input format. The input format is:
Host|IP/NetMask|default|*
Entering default or an asterisk * will allow access to any community
under the configured community string and access mode (public or private).
— Allow Root OID
Input in this field is optional. You can specify the root ID here that is
assigned to the community as an object managed by the MIB (Management
Information Base) system.
A root ID is specified in the following way:
1.2.6.3 ...
— Read-Only Access
Enable this option to allow read-only access (public mode) for the community
in question.
— Add
After specifying the appropriate information, click on this button to add
the new community to the list.
If this action was successful, there is now an entry for this community in the
communities list, which is displayed at the bottom of the section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard. If the number of entries is higher than this number,
the remaining entries are shown on successive pages. A page indicator is then
displayed, where you can select a particular page by clicking on the appropriate
arrow symbols.
To edit an entry, type the appropriate text in the input fields provided with each
entry or enable or disable the corresponding Read-Only Access checkbox.
Then click on Apply Changes to make your settings effective. You can edit
more than one entry and make the changes effective in one go.

Use the following items to perform other activities relating to the list:
• Filter
Configuration
Type a filter expression in the input field of the Community column and
enter it using the Enter key of your keyboard. The list will then display only
entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
Client Lockout
The Client Lockout section looks like this:
Using this section, you can configure options to protect the SNMP Agent
against malicious ways of access.
You can specify the maximum number of authentication failures that is allowed
before access to the SNMP is denied, as well as the duration of this lockout.
A display field shows how many clients have been locked out at a given time.
When configuring options in this section, make sure the checkbox next to the
section heading is marked. After specifying the appropriate values for thes
options, click on Apply Changes to make your settings effective,
The following items are provided in this section:
• Lockout after ... authentication failures
Maximum number of authentication failures before the lockout becomes
effective. The default number is: 15.
• Lock for ... minutes
Duration of the lockout. The default duration is 30 Minutes.
6–97

Configuration
6.7.3
SNMPv3 Users
6–98
• Number of locked clients
This display field shows the number of clients that have been locked out.
Click on the Reset button next to this field to display its the current value.
The SNMPv3 Users tab looks like this:
There is one section on this tab:
• SNMPv3 Users
It is described in the following.

SNMPv3 Users
The SNMPv3 Users section looks like this:
Configuration
Using this section, you can configure the user accounts that are allowed access
to the SNMP Agent according to SNMP protocol version 3 .
In SNMPv3, the User-based Security Model (USM) allows to authenticate
users through password hashes. This means, the password itself is no longer
delivered between peer computer systems, but an irreversible derivative of it,
calculated through either the MD5 or SHA1 hash algorithm.
Optionally, the SNMP Agent can encrypt all data transmitted for this user account,
using either the Digital Encryption Standard (DES) algorithm, as described
in RFC 3414, or the newer Advanced Encryption Standard (AES, also
known as “Rijndael”) algorithm, as described in RFC 3826.
To configure SNMPv3 user accounts, you need to enable the SNMPv3 version
of the SNMP protocol first. To do this, go to the Protocol Options section of
the Agent tab, see 6.7.1.
To add an SNMPv3 user to the list, use the area labeled:
• Add user
Specify the appropriate information using the following items:
— User Name
Enter the name of the user that an account is being configured for in
this input field.
— Password
Enter a password for the user in this field. Note that it has to be at least
8 characters long.
6–99

Configuration
6–100
This is done by entering a host name or an IP address or any other of
the values of the input format. The input format is:
Host|IP/NetMask|default|*
Entering default or an asterisk * will allow access to any community
under the configured community string and access mode (public or private).
— Allow Root OID
Input in this field is optional. You can specify the root ID here that is
assigned to the user account as an object managed by the MIB (Management
Information Base) system.
A root ID is specified in the following way:
1.2.6.3 ...
— Authentication
Select an authentication method for this user by enabling either the
MD5 (default) or SHA algorithm.
The selected algorithm is used to calculate a hash format of the user
password, which is then transmitted during the authentication procedure.
— Encryption
Select an encryption method for the data transferred from this user account
by enabling either the DES (default) or SHA algorithm.
The selected algorithm is then used as the encryption method. Enable
None if you do not want an encrypted data transfer.
— Read-Only Access
Enable this option to allow read-only access (public mode) for the user
in question. Otherwise access will be unrestricted.
— Add
After specifying the appropriate information, click on this button to add
the new user to the list.
If this action was successful, the community is displayed in the user list, which
is displayed at the bottom of this section.

6.7.4
Trap Sinks
The Trap Sinks tab looks like this:
There is one section on this tab:
• Trap Sinks
It is described in the following.
Trap Sinks
The Trap Sinks section looks like this:
Configuration
Using this section, you can configure host systems that are to receive event
notification messages called “traps” in SNMP terminology.
The receiving systems are also known as “trap sinks”.
6–101

Configuration
6–102
SNMP specifies a procedure for event notification called “trap”. Based on this
procedure, the SNMP Agent can be configured to send a trap whenever a
particular event occurs. The trap is sent to a “trap sink”, which is a host system
providing a trap daemon listening on a particular port to receive the trap.
Usually, this daemon is running on the system as part of an SNMP management
application.
A trap can be sent to each trap sink that has been configured to receive it.
Traps are sent in an asynchronous fashion, which means the sending agent
does not wait for acknowledgment, nor does it perform the retransmission of a
trap.
To add a trap sink to the list, use the area labeled:
• Add Trap Sink
Specify the appropriate information using the following items:
— Host
Specify the host system (the trap sink) that is to receive traps from the
SNMP Agent in this input field. To do this, enter a host name or an IP
address.
— Port
Enter the port number for the port of the host system where a trap daemon
is listening to receive traps.
— Community String
Enter a community string (password) here for access to the host system
that is being configured as a trap sink.
Note that this community string allows only read-access (public mode).
— Send SNMPv2c Traps
Enable this option if you want traps to be sent by the SNMP Agent using
SNMP protocol version 2c. Otherwise traps are only sent using SNMP
protocol version 3.
— Add
After specifying the appropriate information, click on this button to add
the new trap sink to the list.
If this action was successful, the trap sink is displayed in the trap sink list, which
is displayed at the bottom of this section.

6.7.5
MIB Browser
The MIB Browser tab looks like this:
There is one section on this tab:
• MIB Browser
It is described in the following.
Configuration
6–103

Configuration
6–104
MIB Browser
The MIB Browser section looks like this:
Using this section, you can view the objects managed by the SNMP Agent in
a MIB tree. To view this tree structure a MIB browser is used.
Within a MIB tree, every individual object is represented under its object type
and assigned to a particular object category. Each object category is itself
assigned to an object category on a higher level, which creates a hierarchical
structure of categories (the MIB tree) ending in a top level category (iso).
So, e. g. the system currently running the SNMP Agent is represented
under the system object type. The categories above this object type are
iso.org.dod.internet.mgmt.mib-2. This means that mib-2 is the category
the system is immediately assigned to.

Configuration
The individual system represented under system has a number of objects
assigned as attributes to it, which are also displayed in the MIB tree, e. g. the
system name, which is represented under sysName. sysName is preceded
by a little arrow to show there is more information available for this entry. A click
on sysName displays its value, i. e. the actual system name, e. g. lupus.
Other properties of sysName are displayed together with its value.
The properties of attribute objects are shown on the MIB browser tabina
separate area below the MIB tree.
Every category, object type or attribute is also identified within the MIB by
a complex number. They are displayed in brackets behind the name of an
item. So, e. g. 1.3.6.1.2.1.1.5 is the equivalent of iso.org.dod.internet.mgmt.mib-2.system.sysName.
The number and the name chain are
different formats of the object ID (OID) of an object. You can browse for sections
of the MIB tree using a root OID, i. e. an OID not leading completely
down to the object type level. So, browsing for e. g. 1.3.6.1 would display all
objects available within the internet category of the MIB tree.
The meaning and usage of the input field and the display fields provided in this
section is as follows:
• Root OIDs
Enter a root OID in this input field to browse for a particular section of the
MIB tree, e. g. 1.3.6.1. fortheinternet category.
Click on the Browse buttontodisplaythissectionintheMIB Tree Area
below this input field.
• MIB Tree Area
In this area, the MIB tree or a section of it is displayed. The section can
be specified by entering a root ID in the Root OIDs input field above this
area.
To show the items assigned to another item within the MIB tree, expand
its structure by clicking on the + sign preceding it. If an item is preceded
by a little arrow, information about its properties, such as its value or OID,
is available in the Object Properties Area below this area. Click on the
item, to display this information.
Use the Expand All and Collapse All buttons just below the bottom right
corner of this area to expand or collapse a MIB tree section.
• Object Properties Area
In this area, the properties of an object selected from the MIB tree are
displayed. An object can be a scalar or a table object. Accordingly, only
one set of properties is displayed for a scalar object, e. g. ifNumber, the
number of interface available on a system.
6–105

Configuration
For a table object, a table of property sets is displayed, e. g. ifTable, an
object providing information about several interfaces sorted in rows with
properties for each instance of an interface.
The following properties are shown for an object:
— Name
Name of the object as displayed in the MIB tree, e. g. SNMPv2-
MIB::sysName.0
This is the format for displaying the name of an object. It contains
the category (SNMPv2) of the corresponding object type (system) and
the object name itself (sysName). The last part of the name is a .0
extension, indicating that the end of an OID chain has been reached.
— OID
OID of the object, e. g. 1.3.6.1.2.1.1.5.0
— Value
Value of the object, e. g. lupus. For the example used here, it means
the name of the system running the Webwasher software is lupus.
— Type
Type of the data providing the object value, e. g. OCTET STRING.
— Description
Text describing the object, e. g. a name assigned by the administrator
to a managed node. If the name is unknown, the value is a zero-length
string.
6.8
Global Command Center
6–106
The Global Command Center options are invoked by clicking on the corresponding
button under Configuration:
If you want to enable any of these options, you also need to mark the checkbox
that is on this button.
Then click on Apply Changes to make this setting effective.

The options are arranged under the following tab:
They are described in the upcoming section:
• Global Command Center, see 6.8.1
6.8.1
Global Command Center
The Global Command Center tab looks like this:
There are five sections on this tab:
• Certificate Creation
• Port Settings
• Server Settings
• Certificate Password
• Device Name
They are described in the following.
Configuration
6–107

Configuration
6–108
Certificate Creation
The Certificate Creation section looks like this:
It enables you to create the certificate that is needed for communication between
Webwasher and the Global Command Center.
The meaning of the buttons provided in this section is as follows:
• Create Certificate
Click on this button to create a new certificate.
• Reload Certificate
Click on this button to use an already existing certificate.
Port Settings
The Port Settings section looks like this:
It allows you to configure the port used by Global Command Center (GCC) to
contact Webwasher. Only change this port if it was changed in GCC as well.
The meaning of the items provided in this section is as follows:
• Port
Port number of the port used by GCC to contact Webwasher. The default
port number is 7072.
• Allow access from
Use this field to configure IP addresses that should have access to this
port.

The input format is:
Configuration
(IP | IP/NetMask | IP range) [, (IP | IP/NetMask | IP range)]*.
Note: Type * to allow everyone access.
Server Settings
The Server Settings section looks like this:
It allows you to configure the name and port of the Global Command Center
(GCC) server. The meaning of the input fields provided here is as follows:
• Server Name or IP Address
Name of the GCC server. This can either be a fully qualified domain name
or an IP address (use the same that was specified in the certificate).
• Server Port
Port number of the GCC server port. The default port number is 7443. Only
change this default number if it was changed in GCC as well.
Certificate Password
The Certificate Password section looks like this:
It allows you to configure the password provided in the certificate used to access
Global Command Center.
The following input field is provided here:
• Password
In this input field enter the password needed for use of the certificate (if
any).
6–109

Configuration
Note: If you used the Create Certificate button of the Certificate Creation
section above or the script provided with Webwasher to create the
certificate, no password needs to be used here.
Device Name
The Device Name section looks like this:
It allows you to configure the name of the Webwasher object created in Global
Command Center (GCC)..
The following input field is provided here:
• Device Name
In this input field enter the device name that is created for the Webwasher
object by the Global Command Center (GCC) Configuration Manager. Use
exactly the same name as in GCC.
6.9
Certificate Management
6–110
The Certificate Management options are invoked by clicking on the corresponding
button under Configuration:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Webwasher Root CA, see 6.9.1
• Private Key Handling, see 6.9.2
• Known Certificate Authorities, see 6.9.3
• Client Certificates, see 6.9.4

6.9.1
Webwasher Root CA
The Webwasher Root CA tab looks like this:
There are two sections on this tab:
• Import Certificate Authority
• Generate New Certificate Authority
They are described in the following.
Configuration
6–111

Configuration
6–112
Import Certificate Authority
The Import Certificate Authority section looks like this:
Using this section, you can import an existing Certificate Authority (CA) for
signing new certificates. You can also import the private key for this CA.
If you are importing a subordinate CA, you can also specify a chain file, i. e.
a file providing information on the complete certificate chain that belongs to
the CA. This information is sent to the client when the SSL handshake is performed.
Use the following input fields and buttons to import a certificate authority:
• Certificate
In this input field enter the certificate you want to import. To do this, browse
for the certificate, which is contained in a *.pem file.
Make sure the certificate you are importing is base64-encoded.
• Private Key
In this input field enter the private key for the certificate. To do this, browse
for the private key certificate, which is contained in a *.pem file.
Make sure the private key you are importing is base64-encoded.
• Password
If the private key is protected by a password, you need to provide here.
• Certificate Chain
Use this input field to specify a certificate chain, i. e. a file providing information
on the complete certificate chain. To do this, browse for this file.
Make sure the file you are importing is base64-encoded.

• Import
Configuration
After specifying the appropriate information in the input fields described
above, click on this button to import the certificate authority.
Generate New Certificate Authority
The section labeled Generate New Certificate Authority section looks like
this:
Using this section, you can generate a new certificate authority.
The purpose of generating a new root CA (Certificate Authority) for Webwasher
is to have your own individual root CA containing correct data, rather than sharing
a common root CA with other Webwasher customers.
If you do not create a new root CA, administrators of Webwasher installations
might be able to decrypt traffic since administrators also know the private key
of domain certificates. Creating or importing a new CA will generate a new
private key for the domain certificates.
To generate a new root CA, fill in the input fields provided in this section, i. e.
Organization*, Organizational Unit, etc.
Input is mandatory for the fields marked with an * (asterisk).
TheclickontheGenerate button, to generate the new certificate authority.
6–113

Configuration
6.9.2
Private Key Handling
6–114
The Private Key Handling tab looks like this:
There are three sections on this tab:
• HSM Agent Setup
• Certificate Issuing Options
• Handshake Options
They are described in the following.

HSM Agent Setup
The HSM Agent Setup section looks like this:
Configuration
Using this section, you can configure settings for the connections to one or
more HSM Agents. Before you proceed with configuring these settings, make
sure you have set up the HSM Agents in question.
Use the following items to configure settings for HSM Agent connections:
• HSM Agents
Enter the IP addresses or host names of the HSM Agents you have set up
in this input field. The input format is as follows:
ip[:port][;ip[:port]]
Webwasher then tries to establish the connections, which will result in either
a positive feedback or an error message.
• Use encrypted connections to HSM Agents
Make sure this option is enabled if you want to use SSL-secured communication
with HSM Agents.
• Use client certificate to authenticate to HSM Agents
Make sure this option is enabled if you also want to have two-sided authentication
between an SSL scanner and an HSM Agent.
In this case you have to import the client certificate that was generated with
the HSM Agent in question. An input field is provided here, together with
a button for searching a certificate. The certificate file for an agent can be
found in the SSL2/private folder. Its name is agentcertkey.pem.
Furthermore, there are two buttons for importing a certificate in different
ways:
— Import client certificate
Click on this button to import a client certificate on the current SSL
Scanner node.
6–115

Configuration
6–116
— Import and distribute client certificate
If the generated certificate is valid for all SSL scanner nodes, click on
this button to have it distributed on all of them. Otherwise, you need to
import a node-specific client certificate on each SSL scanner node.
Note: If you are using client certificate authentication for HSM Agents
in a Webwasher cluster, you need to import a valid client certificate on
each new SSL scanner node in case you extend the cluster.
Only in the simple case (one client certificate for all nodes) can this
be done on the master instance by re-importing the existing certificate
and checking this distributing option. In the complex case, you need to
import a certificate on each new node, using the Web interface.
Certificate Issuing Options
The Certificate Issuing Options section looks like this:
Using this section, you can configure the signing of certificates.
You can move the private key of a CA to an HSM Agent for signing a certificate.
Before configuring the ID of this key, make sure a connection to the HSM Agent
has been set up.
Furthermore, you can import the CA, which is usually created by the HSM
Agent, on the SSL scanner.
Use the following items to configure the signing of certificates:
• Signing operation of new server certificates will be done
— by this Webwasher instance
Enable this option to have the certificate signed by the current instance
of Webwasher.
— by remote service using HSM Agent with key this Webwasher
Enable this option to have the certificate signed by a remote service
using the HSM Agent.

Configuration
To configure this option, a key ID must be entered in the input field
provided here. Before enabling the option, import the certificate, see
below.
• Certificates are valid for . . . days
Enter the number of days the certificates issued by this CA should be valid
in the input field provided here. After the certificates have expired, the SSL
scanner will issue them again if required.
This setting can be configured regardless of whether the current Webwasher
instance or the HSM Agent is used for signing a certificate.
Below this input field, another one is provided for searching and importing
the certificate, using the Browse and Import root certificate buttons
next to it.
Handshake Options
The Handshake Options section looks like this:
Using this section, you can configure the decrypting of the SSL handshake
with the client.
The private key needed for this can also be provided by the HSM Agent.
Before configuring the ID of the key in question, make sure a connection to the
HSM Agent has been set up.
Use the following items to configure handshake decryption:
• Decrypting of handshake will be done
— by this Webwasher instance
Enable this option to have the handshake decrypted by the current instance
of Webwasher.
— by remote service using HSM Agent with key
Enable this option to have the handshake decrypted by a remote service
using the HSM Agent. To configure this option, a key ID must be
entered in the input field provided here.
6–117

Configuration
• Send certificate chain in handshake
Enable this option for configuring the SSL scanner to send the certificate
chain during the handshake.
Usually, the certificate chain contains only the Webwasher CA. If the Webwasher
CA is not self-signed, however, the chain contains all certificates
down to the root CA.
If you have rolled out the Webwasher CA in your company, there is no need
for sending the chain.Login name for an administrator.
6.9.3
Known Certificate Authorities
6–118
The Known Certificate Authorities tablookslikethis:

There are three sections on this tab:
• View Certificate Authority
• Know Certificate Authorities
• Automatic CRL URL Retrieval
They are described in the following.
View Certificate Authority
The View Certificate Authority section looks like this:
Configuration
In allows you to view information on a Certificate Authority (CA). This is information
relating to he CA you selected in the Known Certificate Authorities
section below. You can modify one item of this information, i. e., the URL for
CRL download.
The following information is provided here:
• Validtimespan
Time span over which the CA is valid.
• URI for CRL download
URI (URL) that can be downloaded to obtain a Certificate Revocation List
(CRL).
This information can be modified. To do this, type appropriate text in this
field. Then click on the Modify button at the bottom of the section.
• Number of revoked certificates
Number of certificates that have been issued and revoked by this CA.
The number of revoked certificates can only be displayed if it is known
which URL to use for obtaining the CRL.
To provide this URL, you can either enter it or modify its entry in the URI
for CRL download field, or enable the option for automatic URL retrieval.
6–119

Configuration
6–120
The option for automatic URL retrieval is enabled in the Automatic CRL
URL Retrieval section, which is also located on this tab.
Known Certificate Authorities
The Known Certificate Authorities section looks like this:
Using this section, you can view a list of known Certificate Authorities (CAs)
and import new CAs, which are added to this list.
To import and add new CA, use this area:
• Add certificate(s)
The following items are provided here:
— Certificate(s) file
In this input field, enter the certificate file for the CA you want to import,
using the Browse button next to the field.
Make sure the file you are importing is base64-encoded.

— Import
Configuration
After browsing to the certificate file, click on this button to import it.
If the certificate file was imported successfully, a corresponding entry is
added to the list, which is displayed at the bottom of this section.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using
the Enter key of your keyboard. If the number of entries is higher than this
number, the remaining entries are shown on successive pages.
A page indicator is then displayed, where you can select a particular page
by clicking on the appropriate arrow symbols.
Use the following items to perform other activities relating to the list:
• Filter
Type a filter expression in the input field provided here and enter it using the
Enter key of your keyboard. The list will then display only CAs matching
the filter.
• View
To view a CA, click on this icon in the same line of the list.
• Delete Selected
Select the CA you wish to delete by marking the Select checkbox next to
it and click on this button. You can delete more than one CA in one go.
To delete all CAs, mark the Select all checkbox and click on this button.
Automatic CRL URL Retrieval
The Automatic CRL URL Retrieval section looks like this:
It allows you to configure the storing of URLs for downloading CRLs (Certificate
Revocation Lists). These will be extracted from the vendor certificates and the
issuing CAs when the certificate chain is inspected during the verification of a
signature.
If you want to use this option, make sure the checkbox provided here is marked.
Note that a URL will not be overwritten if it has already been stored.
6–121

Configuration
6.9.4
Client Certificates
6–122
The Client Certificates tab looks like this:
There is one section on this tab:
• Client Certificates
It is described in the following.
Client Certificates
The Client Certificates section looks like this:
Using this section, you can add client certificates to the list of certificates. A
private key and a passphrase must also be specified for this purpose.
The list will be searched in order to authenticate a client that provides a certificate
after being requested by the server to do so.

6.10
DNS Cache
To add a certificate to the list, use the area labeled:
• Add client certificate
Configuration
Specify the information concerning the system you want to enter in the list
using the following input fields and button:
— Certificate file
Enter the certificate file name here. To do this, browse for a certificate
file, using the Browse button next to this input field.
Make sure the certificate file you want to add is base64-encoded.
— Private key file
Enter the name of the private key file here. To do this, browse for a
private key file, using the Browse button next to this input field.
Make sure the private key file you want to add is base64-encoded.
— Passphrase
Enter a passphrase for the private key here.
— Import
After specifying the appropriate information in the input fields described
above, click on this button to import the certificate.
If the certificate was imported successfully, a corresponding entry is added
to the list, which is displayed at the bottom of this section.
The DNS Cache options are invoked by clicking on the corresponding button
under Configuration:
If you want to enable any of these options, you also need to mark the checkbox
that is on this button.
Then click on Apply Changes to make this setting effective.
The options are arranged under the following tab:
6–123

Configuration
6.10.1
DNS Cache
6–124
They are described in the upcoming section:
• DNS Cache, see 6.10.1
The DNS Cache tab looks like this:
There are two sections on this tab:
• DNS Caching
• Flush DNS Cache
They are described in the following.
DNS Caching
The DNS Caching section looks like this:
Using this section, you can configure the time that entries for requests to a
Domain Name Server (DNS) should be stored in the Webwasher cache.

Configuration
After modifying this setting, click on Apply Changes to make the modification
effective.
Use the following input field to configure the caching time:
• Time to live for DNS entries: . . . sec.
Enter the time (in seconds) here that DNS entries should be stored in the
cache. The default time is 60 seconds.
Flush DNS Cache
The Flush DNS Cache section looks like this:
It allows you to remove all entries for requests to a Domain Name Server (DNS)
from the Webwasher cache.
Use the following button to do this:
• Flush DNS Cache
Click on this button to perform the flushing of DNS entries.
6.11
Backup & Restore
The Backup & Restore options are invoked by clicking on the corresponding
button under Configuration:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Configuration, see 6.11.1
• Error Files, see 6.11.2
• Share Folder, see 6.11.3
• Proxy PAC, see 6.11.4
6–125

Configuration
6.11.1
Configuration
6–126
The Configuration tab looks like this:
There are two sections on this tab:
• Backup Configuration
• Restore Configuration
They are described in the following.
Backup Configuration
The Backup Configuration section looks like this:

Configuration
Using this section, you can create and download a configuration backup. You
can include additional in the download, such as the user database, the progressive
lockout data, or the Welcome Page data.
In addition to the data mentioned, a backup configuration contains only configuration
files. It does not contain, e. g. statistics or log files, which need to be
stored separately.
Furthermore, the backup file created here is not meant to be sent to the support
team for troubleshooting. When contacting the support team, please use the
feedback script that is provided for this purpose.
Use the following input fields and button for your backup activities:
• Include User Database
If you want to include this database, make sure this checkbox is marked.
The checkbox is marked by default.
• Include Progressive lock-out data
To include this data, mark this checkbox.
• Include Welcome Page data
To include this data, mark this checkbox. The checkbox is marked by default.
• Download Configuration Backup
After specifying the appropriate information, click on this button to create
and download the backup file.
This is a single file containing all configuration files in compressed form.
Restore Configuration
The Restore Configuration section looks like this:
Using this section, you can restore a Webwasher configuration that was previously
backed up and stored.
6–127

Configuration
6.11.2
Error Files
6–128
Use the following input field and buttons for restoring:
• Restore configuration from file
To restore a previously saved configuration, click on the Browse button
next to this input field and select the desired file or enter the complete path
leading to the file. Then click on the Restore button.
Restoring a configuration will not overwrite any configuration files immediately.
For this to happen, you have to restart Webwasher manually.
Note that you can only restore a configuration to a Webwasher version
running on a particular machine if it was backed up on the same machine.
The Error Files tab looks like this:
There is one section on this tab:
• Manage Error Templates
It is described in the following.

Manage Error Templates
The Manage Error Templates section looks like this:
Configuration
It allows you to manage the error templates used by Webwasher. You can
download templates from the corresponding Webwasher folder and upload
them from an external location.
This may be useful, e. g. if you want to modify templates in order to adapt
them to your corporate standards.
Use the following items to perform the download or upload:
• Download all (tar.gz)
Click on this button to download all error templates.
The templates are stored in the conf/errors folder of the Webwasher installation
directory. If you are using error templates in different languages,
they will be stored in subfolders with corresponding language short names,
such as en, fr, de, etc.
The download will provide a file in tar.gz format.
• Upload error files from
In this input field, enter the path and file name for an upload of error templates
or browse to it using the Browse button next to this field.
Then click on the Upload button to perform the upload.
6–129

Configuration
6.11.3
Share Folder
6–130
The Share Folder tab looks like this:
There is one section on this tab:
• Manage Share Folder
It is described in the following.
Manage Share Folder
The Manage Share Folder section looks like this:
This section allows you to manage the files in the Webwasher share folder.
You can download files from this folder and upload them to it from an external
location.
This may be useful, e. g. if you want to modify files in order to adapt them to
your corporate standards.

6.11.4
Proxy PAC
Configuration
Use the following items to perform the download or upload of shared files:
• Download all (tar.gz)
Click on this button to download all files from the share folder.
The templates are stored in the lib/files folder of the Webwasher installation
directory under UNIX and in the bin\/files folder of the same directory
under Windows.
The download will provide a file in tar.gz format.
• Upload files from
In this input field, enter the path and file name for an upload of files from
the share folder or browse to this folder it using the Browse button next to
the field.
Then click on the Upload button to perform the upload.
The Proxy PAC tab looks like this:
There is one section on this tab:
• Client Configuration
It is described in the following.
6–131

Configuration
6–132
Client Configuration
The Client Configuration section looks like this:
Using this section, you can upload a proxy.pac file to enable central administration
of your proxy configuration. You can also configure the length of time
that a proxy.pac file should be stored for on a client.
Proxy Automatic Configuration is a proxy mode where the proxy configuration
is described in a file using JavaScript, called a PAC file, with .pac as file extension.
The file is maintained by the network administrator and requires no
user updating (hence "automatic"). As a browser user, you only need a URL
provided by your administrator.
Proxy Automatic Configuration has two advantages over normal configurations:
• Network-based .pac files are centrally administered and easy to update.
Network administrators usually share the .pac files via HTTP. If there are
server changes or network outages, the .pac file can be changed, and your
browser configuration will be automatically updated when the new .pac file
is loaded.
• You can use complicated network environments with a single configuration.
PAC has support for load balancing and failover.
All of today’s current browsers have the facility to use .pac files. The Javascript
contained within a .pac file can perform tasks and make decisions based on
the URL you are browsing to, the IP address of your browser, which proxy
should service the traffic and which other proxies should be used alternatively.
A method that may be used in order to ensure that browsers are able to find the
central proxy .pac file is using the WPAD (Web Proxy Autodiscovery Protocol)
standard. This standard defines two alternative ways for the administrator to
publish the location of a proxy configuration file: DHCP (Dynamic Host Configuration
Protocol) and DNS (DomainNameSystem).
Before fetching its first page, a Web browser implementing the WPAD method
sends the local DHCP server a DHCPINFORM query, and uses the URL from
the WPAD option in the server’s reply. If the DHCP server does not provide
the desired information, DNS is used.

Configuration
So, if the network name of a user’s system is, e. g. pc.department.branch.example.com,
the browser will try the following URLs
in turn until it finds a proxy configuration file:
• http://wpad.department.branch.example.com/wpad.dat
• http://wpad.branch.example.com/wpad.dat
• http://wpad.example.com/wpad.da
• http://wpad.com/wpad.dat
Note that these are examples and not live URLs.
If you want to make use of the proxy .pac file method, click on the link provided
in this section to access a proxy .pac file, or use the following items to upload
one:
• Upload proxy.pac from ...
In this input field, enter the path and file name for the proxy .pac file. You
can either type this information or use the Browse buttontobrowsetoa
location where a proxy .pac file is stored.
• Upload files from
After specifying a proxy .pac file in the input field, click on this button to
upload it.
To configure the maximum amount of time that a proxy.pac file should remain
stored on a client, use the following input field:
6.12
Action Editor
• Clientsshouldstoreproxy.paconlyfor...seconds
Enter a time length (in seconds) here. The default length is 3600 seconds.
The Action Editor options are invoked by clicking on the corresponding button
under Configuration:
The Action Editor is provided for configuring actions of your own, which can
be used in addition to the pre-configured actions Webwasher is shipped with.
These are also known as built-in actions.
To view a list of the built-in actions, click on the question mark above the tabs.
The list is also provided in the section 3.1 of the Reference Guide
6–133

Configuration
6.12.1
Action Editor
6–134
The options of the Action Editor are arranged under the following tabs:
They are described in the upcoming sections:
• Action Editor, see 6.12.1
• Notifications, see 6.12.2
Furthermore, there is a description of the Action Definition tab.
This tab is provided for configuring further the settings of an action that has
been newly created and for editing existing user-configured actions:
• Action Definition, see6.12.3
The Action Editor tab looks like this:
There is one section on this tab:
• Actions
It is described in the following.

Actions
The Actions section looks like this:
Configuration
Using this section, you can configure your own actions and add them to the
list of built-in actions, i. e. the actions Webwasher was shipped with. You can
also edit actions you have previously configured yourself.
Note, however, that to make any of the settings you configure here effective,
you need to restart Webwasher manually.
The actions can in turn be configured for the various filters of Webwasher, and
are executed when a filter applies.
To view a list of the built-in actions, click on the question mark above the tab.
The list is also provided in the section 3.1 of the Reference Guide.
In the upper part of this section, a list is displayed of the actions that have been
configured by users so far.
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To edit an action, click on Edit button next to it. This will take you to the Action
Definition tab, where you can modify the settings of the action. The tab is
described in the next subsection.
6–135

Configuration
6–136
Use the following items to perform other activities relating to the list:
• Filter
Type a filtering term in this input field and enter it using the Enter key of
your keyboard. The list will then display only entries matching the filter.
• Delete Selected
Select the entry you wish to delete by marking the Select checkbox next
to it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
To configure a new action use the following items at the bottom of the section:
• Create New
After clicking on this button, a NewAction entry is displayed in the list of
user-configured actions.
Continue the configuration of the new action by clicking on the Edit button
next to it.
This will take you to the Action Definition tab, where you can modify the
settings of the action. The tab is described in the next subsection.
• Create New From Existing
This button allows you to use an existing action as starting point for configuring
a new action. A drop-down list showing all built-in and user-configured
actions is also provided.
To use one of these actions as starting point, select it and click on the
button. Another entry will then be added to the list named New.
To continue the configuration of this action, click on the Edit button as
described above.

6.12.2
Notifications
The Notifications tablookslikethis:
There is one section on this tab:
• Notification Recipients
It is described in the following.
Notification Recipients
The Notification Recipients section looks like this:
Configuration
6–137

Configuration
6–138
Using this section, you can configure the recipients of e-mail notifications. You
can also configure the settings of the notification server and send test e-mails.
Note that these settings will apply only under a particular policy. Select this
policy from the drop-down list above the section.
After specifying the appropriate settings, click on Apply Changes to make
them effective.
Use the following items to configure notifications:
• Recipient for general notifications
In this input field, type the e-mail address of the recipient that notifications
should be sent to on general occasions.
• Recipient for virus notifications
In this input field, type the e-mail address of the recipient that notifications
should be sent to if a virus threat has occurred.
• Postmaster addresses
In this input field, type one or more e-mail addresses for notifications to the
postmaster.
• Edit Notification Mail Server
Click on this button to open a window where you can configure the settings
of the mail server that is used for sending notifications.
For a description of this window, see the Notification Settings Window
subsection of 5.5.3.
• Send Test Messages
After configuring the notification settings, click on this button to send test
e-mail messages.

6.12.3
Action Definition
The Action Definition tab looks like this:
Configuration
At the top of the tab, there is a link that takes you back to the Actions tab.
Furthermore, there is one section on this tab:
• Action Definition
It is described in the following.
A sample procedure for configuring an action is also described after the Action
Definition subsection:
• Configuring an Action for Dropping E-Mails
This is followed by a subsection that lists and describes shortly the parameters
that can be configured with an action:
• Parameter List
A procedure for configuring an action that exempts overlapping categories with
regard to URL filtering can be found in section 4.4.2 of the URL Filter Guide.
6–139

Configuration
6–140
Action Definition
The Action Definition section looks like this:
Using this section, you can configure the settings of a newly created action or
edit the settings of an already existing user-configured action.
You can specify or edit the name of the action and also what should be executed
for this action with regard to Web and e-mail traffic. Furthermore, you
can configure a number of additional action parameters.
Note, however, that to make any of the settings you configure here effective,
you need to restart Webwasher manually.
The action settings are entered in a special configuration file. For more information
about this file, see section 3.3 of the Reference Guide.
A sample procedure for a user-configured action is described in the next subsection.
Use the following items to configure an action:
• Name of Action
Use this input field to specify or edit the name of an action.
• Web Action
From this drop-down list, select the activity that should be performed for
Web traffic as part of this action.

• Email Action
Configuration
From this drop-down list, select the activity that should be performed for
e-mail traffic as part of this action.
• Apply Above Changes
After specifying the appropriate information, click on this button to make
your settings effective.
In the lower part of the section, a list is displayed showing the parameters that
have been configured for the action so far. A short description of the parameters
that are available here is given in the Parameter List subsection further
below.
Next to each parameter name, the current parameter value is shown in brackets
if it is not too long. Note that only non-default parameters are shown here.
If you set the value of a parameter to its default, it will disappear from the list.
Use the following items to delete or edit list entries:
• Delete Selected
Select the entry you wish to delete by marking the checkbox in the Select
column next to it and click on this button. You can delete more than one
entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
• Edit Selected
Select the entry you wish to edit by marking the checkbox in the Select
column next to it and click on this button, or just click on the parameter
name.
This will take you to the Action Parameter tab for that particular parameter,
where you can modify its settings.
After completing the modification, you are returned to this tab, i. e. the Action
Definition tab, and the changed settings are shown in the parameter
list of the action you are currently configuring.
To add a parameter to the list for an action, use the following items at the bottom
of the section:
• Parameters
From the drop-down list provided here, select a parameter you want to
configure for an action.
6–141

Configuration
6–142
• Add
After selecting a parameter, click on this button. This will take you to the
Action Parameter tab for that particular parameter, where you can configure
its settings.
Upon completion of these configuration activities, you are returned to this
tab, i. e. the Action Definition tab, and the parameter in question is
added to the parameter list of the action you are currently configuring.
Configuring an Action for Dropping E-Mails
The following is a sample procedure for a user-configured action. The action
drops an e-mail if the corresponding filter applies and sends a notification to
the sender of the e-mail.
The first steps of this procedure have already been performed on the Actions
tab. There, you clicked on the Create New and the Edit button, which took
you to the Action Definition page.
Now continue with the following steps:
1. In the Name of Action input field, edit the name of the action. So far it
is NewAction. Enter Drop Mail and Notify Sender as action name.
2. From the Web Action drop-down list, select Block as the action that is
to be executed if the filter applies.
3. From the Email Action drop-down list, select Drop.
4. Click on the Apply Above Changes button to make these initial settings
effective.
5. This step and the following are performed to configure the parameters of
the action.
In most cases, it is a good idea to begin with specifying a value for the
Protocol Selection parameter. This will determine the type of communication
the action is configured for, i. e. Web or e-mail communication.
Select Protocol Selection from the Parameter drop-down list and click
Add. This takes you to the Action Parameter tab, where you can further
configure the parameter settings.
6. In the Action Parameter section of that tab, select Email from the Protocol
drop-down list and click on the Apply Changes and Go Back
button.
This takes you back to the Action Definition tab, where you can continue
with adding another parameter to the action.
On this tab, you will also see the Protocol Selection parameter you have
just added as an entry in the Parameter List.

Configuration
The value you configured for this parameter, i. e. Email, is displayed in
brackets behind the parameter name.
7. Continue with configuring the Filter Selection parameter. It is used to
determine the filters that the action is intended for.
Accordingly, the action will only be displayed for selection in drop-down
lists on the Web pages that are used for configuring these filters.
Select Filter Selection from the Parameter drop-down list and click
Add. This takes you to the corresponding Action Parameter tab.
8. In the Action Parameter section of that tab, enter the word Spam to
specify the spam filter.
Then click on the Apply Changes and Go Back button. This takes you
back to the Action Definition tab, where you can continue with adding
another parameter to the action.
9. Continue with configuring the Notify parameter. Under this parameter,
you specify who should be notified and what the notification should look
like.
Select Notify from the Parameter drop-down list and click Add. This
takes you to the corresponding Action Parameter tab.
10. In the Action Parameter section of that tab, there is another section
embedded, which is labeled Add Element. Specify the values for the
Notify parameter using the input fields and the drop-down list provided
in the embedded section:
Template Name - This input field is used to enter the name of the template
file that is to appear as a notification. It is entered without an extension.
The template file must have been created before and stored in a folder
under the Webwasher program files. On a Windows platform, this would
be the conf\errors folder.
Enter emailblocked as template name.
Email Subject - This input field is used to enter the text that is to appear
as subject line of the notification.
Enter The mail has been blocked as subject line.
Recipient - This input field is used to enter the recipient of the notification.
Variables can be entered here.
Enter %sender as recipient. The notification will then be sent to sender
of the e-mail that was blocked.
6–143

Configuration
6–144
Option String - This drop-down list provides a number of options for activities
that will be performed together with the notification, e. g. including
the blocked mail or its header with the notification.
Select All as an option. This will cause all available activities to be performed.
11. After specifying the settings for the parameter as described above, click
on the Add button in the embedded section.
The values specified in this section are now displayed in a list further
below this labeled List of Notify Elements.
12. Click on the Apply Changes and Go Back button. This takes you back
to the Action Definition tab.
You will see the Notify parameter added to the Parameter List, but no
values are displayed due to their complexity.
This completes the configuration of the Drop Mail and Notify sample action.
In order to make it available for configuring the filter you specified, i. e. the
spam filter, you need to restart Webwasher manually.
Parameter List
The following list provides short descriptions of the parameters that can be
configured with an action:
Parameter Meaning
Custom Headers Add customized header to HTTP/SMTP message
Custom Logs Writetocustomizedlogfile
Custom Meta Headers Add customized meta header to ICAP message
Custom Parameters Add customized parameters to transaction
Delay (SMTP) Delay e-mail
Email Footer Add footer to e-mail
Email Header Add header to e-mail
Error Template Use specific error template
Filter Anti Selection Specify where not to show action in Web interface
Filter Selection Specify where to show action in Web interface
HTTP-Error Change code number for HTTP error
Notify Send notification messages
Notify-Gateway Use non-standard gateway for notifications

6.13
Wizards
Parameter Meaning
Progressive Lock-out Lock out user for increasing time intervals
Protocol Selection Show for Web/e-mail only in Web interface
Queue-Copy Write copy of e-mail to queue
Quota Use time and/or volume quota
Redirect URL Redirect to other URL
Severity Change default severity of action
Sleep Delay action by “sleeping” interval
Subject-Prefix Insert string at beginning of subject
Syslog Write to system log file
Time Scheme Name Applytimeschemetoaction
Trap Event Send SNMP trap message
Warning Template Add coaching/quota template
Configuration
The Webwasher wizards are provided to assist you in completing a number of
configuration tasks. They are invoked by clicking on the corresponding button
under Configuration:
Each wizard is arranged under a tab of its own. There are the following tabs
and wizards:
They are described in the upcoming sections:
• Reporting Configuration, see 6.13.1
• Spam Filter Setup, see 6.13.2
• LDAP Configuration, see 6.13.3
6–145

Configuration
6.13.1
Reporting Configuration
6–146
The Reporting Configuration tab looks like this:
The Reporting Configuration Wizard, which is provided on this tab, simplifies
the process of configuring Live Reports and log files.
After answering either Yes or No to the questions listed, click on the Configure
button. Your answers will be processed and the results will be listed as either
unchanged or updated.
Authentication is required in order to be able work with this wizard. This means
that you have to submit two passwords after clicking on Configure.

6.13.2
Spam Filter Setup
The Spam Filter Setup tab looks like this:
Configuration
The Spam Filter Setup Wizard, which is provided on this tab, will assist you in
configuring the SMTP gateway for maximum protection against spam.
Using this wizard, you perform this configuration procedure in 8 steps.
After configuring the settings for each step, click on the Save and Continue
button at the bottom of the tab to proceed to the next step.
6–147

Configuration
6.13.3
LDAP Configuration
6–148
The LDAP Configuration tab looks like this:
The LDAP Configuration Wizard, which is provided on this tab, will assist you
in configuring the LDAP settings used for authentication and policy mapping.
There are four kinds of LDAP configuration tasks you can perform with this
wizard:
• LDAP authentication at the HTTP proxy
• LDAP authentication at the ICAP server
• LDAP authenticationat the SMTP gateway.
• LDAP authentication with User Database
The number of steps needed depends on which of these configuration tasks
you wish to complete.
After configuring the settings for each step, click on the Continue button at
the bottom of the tab to proceed to the next step.

6.14
Debugging
6.14.1
Debugging
Configuration
The Debugging options are invoked by clicking on the corresponding button
under Configuration:
The options are arranged under the following tabs:
They are described in the upcoming sections:
• Debugging, see 6.14.1
• Tracing, see 6.14.2
• Adjust Filter List, see 6.14.3
• Analyse Object Filtering, see 6.14.4
• E-Mail Troubleshooting, see 6.14.5
The Debugging tab looks like this:
6–149

Configuration
6–150
There are four sections on this tab:
• Exception Logging
• SSL Debug Logging
• SMTP Debug Logging
• Notify on Termination
They are described in the following.
Exception Logging
The Exception Logging section looks like this:
Using this section, you can provide a method for tracing Webwasher. When
an exception occurs, exception logging writes these (thrown) exceptions to the
exception log file.
Note that this is a time and bandwidth consuming feature. You should therefore
only enable it after consulting the Webwasher support team.
To enable exception logging, mark the checkbox next to the section heading.
Then click on Apply Changes to make this setting effective.
SSL Debug Logging
The SSL Debug Logging section looks like this:
Using this section, you can configure SSL debug logging. The logging data
is written in the ssl/log folder. You can select a level of detail for the logging
process.
After selecting a level, click on Apply Changes to make this setting effective.
Use the following drop-down list to configure SSL debug logging:
• Level of detail
Select the level of detail for the SSL debug logging here. There are five
levels, ranging from no logging to verbose logging.

SMTP Debug Logging
The SMTP Debug Logging section looks like this:
Configuration
Using this section, you can configure SMTP debug logging. The logging data
is written in the SMTP debug log file. You can select a level of detail for the
logging process.
After selecting a level, click on Apply Changes to make this setting effective.
Use the following drop-down list to configure SMTP debug logging:
• Level of detail
Select the level of detail for the SMTP debug logging here. There are seven
levels, ranging from no logging to extremely verbose logging.
Notify On Termination
The section labeled Notify On Termination looks like this:
Using this section, you can configure a notification to be sent to an administrator
upon unexpected program termination.
The activities that are performed if this notification is enabled include sending
an e-mail as well as an SNMP trap notification to the administrator and filing a
syslog entry.
To enable the notification, make sure the checkbox next to section heading is
marked. The checkbox is marked by default.
After modifying this setting, click on Apply Changes to make the modification
effective.
6–151

Configuration
6.14.2
Tracing
6–152
The Tracing tablookslikethis:
There is one section on this tab:
• Connection Tracing
It is described in the following.
Connection Tracing
The Connection Tracing section looks like this:
Using this section, you can trace the connections used for communication
with Webwasher. Since this a is time-consuming and data-intensive feature,
however, you should configure it only after consulting the Webwasher support
team.
To enable the feature, mark the checkbox next to the section heading.
After specifying this setting or the setting for the single source IP in this section,
click on Apply Changes to make these settings effective.

Configuration
You can also restrict the tracing process to one single source IP. To do this,
use the following input field:
• Trace connection only for source IP
Enter the IP address for the connection you want to trace here. Make also
sure that the checkbox provided in this field is marked.
To view a list of the traced connections, click on the list of traced connections
link provided below the input field. The list will be displayed in a separate
browser window.
6.14.3
Adjust Filter List
The Adjust Filter List tab looks like this:
When configuring settings on this tab, you need to specify the policy these
settings are relating to. To do this, select a policy from the drop-down list at
the top of the tab:
There is one section on this tab:
• Filter Tracing
It is described in the following.
6–153

Configuration
6–154
Filter Tracing
The Filter Tracing section looks like this:
Using this section, you can trace the activities performed by any of the Webwasher
filters. Since this feature uses a large amount of operating memory
and disk space, it should be turned on only as part of a diagnostic procedure
and turned off promptly when it is no longer required.
The filters tracing folder is found in the filters directory of the Webwasher program
files under logs. Should an object be blocked, the reason why it was
blocked is also written into the log file.
Use the items in the following area to configure filter tracing:
• Select a filter
Select a filter from the drop-down list provided here in order to add it to the
list of filters you want to retrieve tracing information for.
If you want detailed information on this filter, mark the Print filter details
checkbox after selecting the filter.
Furthermore, use the following items:
— Add Filter
After specifying the appropriate information, click on this button to add
afiltertothetracinglist.
— Add All Filters
Click on this button to add all filters to the list that are available within
Webwasher and can be traced.
If you want detailed information on all these filters, mark the Print details
for all filters checkbox before clicking on the button.
— Delete All Filters
Click on this button to delete all filters on the tracing list.
The filter tracing list is displayed at the bottom of this section.

Configuration
To display only a particular number of list entries at a time, type this number
in the input field labeled Number of entries per page and enter it using the
Enter key of your keyboard.
If the number of entries is higher than this number, the remaining entries are
shown on successive pages. A page indicator is then displayed, where you
can select a particular page by clicking on the appropriate arrow symbols.
To activate or deactivate tracing or the Print details function for a particular
filter, mark or clear the corresponding checkboxes.
Then click on Apply Changes to make these settings effective. You can edit
more than one filter entry and make your settings effective in one go.
Use the following items to perform other activities relating to the list:
• Filter
Type a filtering term in this input field and enter it using the Enter key of
your keyboard. The list will then display only entries matching the filter.
• Delete Selected
Select an entry you wish to delete by marking the Select checkbox next to
it and click on this button. You can delete more than one entry in one go.
To delete all entries, mark the Select all checkbox and click on this button.
6–155

Configuration
6.14.4
Analyse Object Filtering
6–156
The Analyse Object Filtering tab looks like this:
There is one section on this tab:
• Analyse Object Filtering
It is described in the following.
Analyse Object Filtering
The Analyse Object Filtering section looks like this:
This section allows you to trace and analyze the filtering that was performed
by Webwasher for a particular object.

Use the following items to analyze the filtering of an object:
• URL
Configuration
In this input field, enter the URL of the object you want to trace filtering for.
• Select policy
From the drop-down list provided here, select the policy the settings of this
sections are relating to.
• Use next hops
Mark this checkbox you want to use a proxy server for the tracing.
Specify this proxy server in the following input fields:
• Analyze Filtering
After specifying the appropriate information,, click on this button to perform
the filtering analysis for the object in question.
• Rotate Filter Log
Click on this button to renew the content of the log file and remove older
entries from it.
6–157

Configuration
6.14.5
E-Mail Troubleshooting
6–158
The E-Mail Troubleshooting tab looks like this:
Warning: The actions and settings provided in these sections affect the e-mail
gateway directly and are applied immediately without further warning or confirmation.
They should therefore only be used under guidance of the Webwasher support
team, as an incorrect usage may result in loss of e-mail or other unwanted
behaviour.
There are two sections on this tab:
• SMTP Gateway
• Queues
They are described in the following.

SMTP Gateway
The SMTP Gateway section looks like this:
Configuration
It displays the status of the SMTP Gateway and allows you to suspend and
resume this gateway.
The following information on the gateway status is provided:
• Status
Status of the gateway, e. g. Running.
• Mode
Mode the gateway is running in, e. g. Normal.
Use the following buttons to change the gateway status:
• Suspend Gateway
Click on this button to suspend the gateway.
• Resume Gateway
Click on this button to let the gateway resume its activities after being suspended.
Queues
The Queues section looks like this:
This section allows you to manage the e-mail queues maintained by Webwasher.
6–159

Configuration
6–160
A list of the e-mail queues is shown in this section. The meaning and usage
of its columns is as follows:
• Queue Name
Name of an e-mail queue, e. g. Inbound, Infected, etc..
• Actions
This column provides the following action buttons:
— Reset delayed
Click on this button to reset a queue.
— Drop Mails
Click on this button to drop all e-mails in a queue.
— Disable Accept
Click on this button to disable the acceptance of e-mails for a queue.
This is a toggle button. After clicking on it for disabling e-mail acceptance,
it reads Enable Accept and can be used for enabling it.
— Disable Processing
• View
Click on this button to have no more e-mails processed in a queue.
This is a toggle button. After clicking on it for disabling e-mail processing,
it reads Enable Processing and can be used for enabling it.
This column provides the following links:
— Entries
Click on this link to view the entries in a queue.
— Performance
Click on this link to view performance data related to a queue.