To understand which method to use, you need to understand the used technology.
¶ The web-filtering method using ACLs Proxy
This method consists in adding a category object to the ACL rules.
When the proxy evaluates the rule, it will test all the objects in the rule, including the Web filtering object.
Personal categories are compiled locally and take precedence over official Artica Tech categories.
To determine a category for a website, Artica will perform a DNS lookup on the Artica Cloud servers.
¶ The web-filtering method using Web-filtering service
This method uses a dedicated engine with its own rules.
Unlike the first method, which searches for website categories via DNS, this one downloads the 60 million websites regulary and loads them locally.
This means that this service will cost at least 2.5gb of memory to store the categories.
The rules principle doesn't work like ACLs.
ACLs use the set of objects associated with the rule to block and pass requests.
Web filtering only focuses on the source (IP addresses or Active Directory users/groups).
If a source matches a rule, then the black and white lists will be processed and the processing of subsequent rules will be stopped.
¶ Can i use both ?
Yes, both methods can be played, processing will be sequential:
ACls come first and web filtering comes second...
¶ What are benefits using Web-filtering service ?
- If you want a simple method of Web filtering that doesn't mix with ACLs, this is a good solution.
- If you have personal categories with millions of websites, then this is the fastest method.
- You can also centralize Web filtering if you have several proxies, by creating an Artica server dedicated to this function.
- A dedicated event viewer is available
¶ What are limits using the Web-filtering service ?
- Web filtering is costly in terms of bandwidth (downloading category sets) and memory (2.5gb minimum).
- Web filtering can only filter users by source IP address and/or user account/group. Any other method is not supported (e.g. MAC addresses).
¶ What are benefits using ACLs and Categories object ?
- You have more freedom to create your own rules; this is similar to a firewall: all objects, including categories, must match.
- Acls via DNS queries don't require extra memory or database downloads.
¶ What are limits using ACLs and Categories object ?
- Using ACls can become complex, and managing site blocking can be even more so.
Web filtering is then mixed up with all the other rules for routing browsing, which can make access very complex to read.