M86 Web Filtering and Reporting Suite

Overview:

The award-winning M86 Web Filtering and Reporting Suite (WFR) helps organizations enforce AUPs and comply with regulations easily. Known for its fast performance and multi-tiered administration capabilities, the M86 WFR sits outside the flow of network traffic to quickly and accurately filter millions of websites in 100+ categories—without impacting bandwidth or productivity.

Highlights

	Safe Access to YouTube Integrates with M86's free VuSafe service, as well as other video filters, to give K-12 students secure access to educational YouTube videos.
	Extensive Application Control Filters Web traffic on all TCP ports and scans hundreds of applications to identify and deny applications that conflict with policies or abuse bandwidth.
	High Scalability Segments one appliance into several independent operating groups with their own rules and policies using strong multi-tiered administration capabilities.
	Regulatory and AUP Compliance Helps schools and other organizations comply with regulations such as CIPA and enforce AUPs using flexible policy administration, detailed on-box reporting or dedicated stand-alone reporting.

Features and Benefits:

Benefits

• Productive, compliant Internet access
  The WFR filters all Web traffic on all TCP ports by URL and/or IP address, file type, HTTP, HTTPS, FTP, newsgroups (NNTP) and TCP. It scans millions of websites, classifying them into hundreds of categories to meet custom policy needs.
• Minimal latency and unmatched reliability
  The fast, high-performance M86 WFR deploys passively (and is not a proxy), so it introduces no network latency, and will not affect the network or Internet connection if it slows or goes down.
• Safe Access to Online Videos
  Both the WFR 4.1 and SWG 10.1 integrate with VuSafe, a free online video library that enables teachers to share YouTube videos with students in a secure environment. This protects students from inappropriate content and ensures that schools comply with internal AUPs and/or regulatory mandates such as CIPA. Education customers who use the WFR or SWG with VuSafe receive the added benefit of being able to block direct YouTube access, while still allowing full use of VuSafe.
• Extensive application control
  M86 WFR uses intelligent packet signature scanning to identify applications based on what they do and then deny the ones that perform functions that conflict with policy. It monitors all TCP ports (not just the two or three common ports) to identify the ever-increasing number of applications that use less-traditional ports for access. These two unique measures enable the M86 WFR to control hundreds of applications to preserve bandwidth, eliminate anonymizers and prevent malware-spreading applications from burdening a network.
• Highly scalable and flexible
  M86 WFR has some of the most robust multi-tiered administration capabilities of any Web filter solution. It can segment one appliance into several independent operating groups with their own rules and policies. For further convenience, groups can be created based on IP range, LDAP or AD groups.
• Easy to install and maintain
  M86 WFR is a "set it and forget it" appliance. Initial setup and installation are intuitive and offer many user-friendly settings. Once installed, there is virtually no ongoing maintenance unless users or groups require change, policies need updating or other unavoidable, non-product-related maintenance is necessary.
• Regulatory and AUP Compliance
  Helps schools and other organizations comply with regulations such as CIPA and enforce AUPs using flexible policy administration, detailed on-box reporting or dedicated stand-alone reporting.

Features

• M86 Web Filter Database
  Filters the Internet via URLs and/or IP addresses, file types (e.g. MP3, MPEG, .zip), HTTP, HTTPS, FTP, Newsgroups (NNTP), and TCP ports. Includes security categories on spyware, malicious code and phishing sites.
• Application Control
  Uses M86 Security's Intelligent Footprint Technology (IFT) to block Instant Messaging and P2P servers by signature or pattern. Blocks 100+ applications.
• Internet Usage Policy Control
  Provides administrators the ability to block, warn or implement quotas on Internet use.
• "X-Strikes" Blocking
  Locks down a user's workstation when administrator-defined thresholds for accessing inappropriate websites are exceeded.
• Web Proxy Pattern Blocking
  Blocks anonymous proxies using signature-based/network pattern detection.
• On box Reporting
  Built-in detailed reporting includes: Single interface for real time, productivity and security reports; simplified GUI navigation; historic bandwidth usage; enhanced executive summary reports; color-coded graphs.
• Google/Yahoo! SafeSearch Enforcement
  Forces the SafeSearch mode "on" for all searches, including images within the Google or Yahoo! search engines.
• Calendar-based Time Profiles
  Time profiles can be set to the calendar by day, day of the week or day of the month. Recurrences can be configured for daily, weekly, monthly and yearly settings.
• Real-time Threat Dashboard
  Offers up-to-the-minute graphical "gauge view" of online activity, displaying an organizational snapshot of multiple threat categories and "top offenders" based on predefined thresholds and policies. Gauges are easily customizable to monitor different groups and threats.
• Intuitive Executive Reports
  Quickly identify anomalous Internet activities through easy-to-read graphical reports, including the top-blocked users, top categories, top sites, etc.
• Custom or "Canned" Reports
  Generates "canned" reports using pre-set templates for quick reference, then drill-down for more detail and customization.
• Detailed Forensic Reporting
  Provides several unique criteria that help organizations build compelling forensic reports. "User intent" is gauged by documenting the full length URLs visited, as well as the "search string" used within a search engine text box.
• Optional Remote User/Laptop Filtering
  Extends an organization's Internet usage and security policies to remote users with the M86 Mobile Client option. Compatible with MACs and PCs.
• Customized Time Settings in Web-based Authentication
  Organizations can assign custom time limits on Web access by user group or IP group.

Reporting:

• On-box Reporting
  Includes single interface for real-time, productivity and security reports; simplified GUI navigation; historic bandwidth usage; enhanced executive summary reports; colorcoded graphs.
  
  
• Real-time Threat Dashboard
  Offers up-to-the-minute graphical "gauge view" of online activity, displaying an organizational snapshot of multiple threat categories and top offenders based on predefined thresholds and policies. Gauges are easily customizable to monitor different groups and threats.
  
  
• Intuitive Executive Reports
  Identifies anomalous Internet activities through easy-to-read graphical reports, including the top-blocked users, top categories, top sites, etc.
  
  
• Custom or "Canned" Reports
  Generates "canned" reports using pre-set templates for quick reference, then drill-down for more detail and customization.
  
  
• Detailed Forensic Reports
  Provides several unique criteria that help organizations build compelling forensic reports. User intent is gauged by documenting the full length URLs visited, as well as the search string used within a search engine text box.

Deployment Options:

Below are various options for installing a single M86 Web Filtering and Reporting appliance. The appliance can be deployed in pass-by/SPAN port mode (outside the flow of traffic) or pass-through mode (within the flow of traffic).

Pass-by/SPAN Port Mode

The M86 WFR is one of few Web filters that can be deployed outside the flow of network traffic. This type of deployment makes the WFR transparent to the network and totally uninvolved in the routing of packets from client to Internet. This allows for automatic redundancy and automatic fail-safe. If the M86 WFR should fail and filtering stops, the network traffic is unaffected.

In the diagram below, the M86 WFR is connected to the managed switching hub. The M86 WFR port is configured with the "port monitoring" function enabled. This allows it to mirror the port that is connected to the router. The diagram below also illustrates how URL requests are handled when the WFR is deployed outside the path of network traffic.

1. Inappropriate request is sent by user
2. M86 Web Filter monitors request as it passes through the hub/switch
3. M86 Web Filter matches the request against its database
4. If the website requested finds a match in the database, a TCP reset is sent to the Web server to kill the session (request). A block page is sent to the client.

Pass-by/Router Mode

This mode allows the M86 WFR to act as an Ethernet router, passing packets from one card to the other. As the packets pass through the M86 WFR, they are scanned and categorized. In this model, only outgoing packets need to be routed, allowing the M86 Web Filter to appear only in the outgoing path of the network traffic which limits the latency. In router mode, the original packets from the client are allowed to pass in all cases (just as if the WFR were an Ethernet router), but if the request is inappropriate, a block page is returned to the client to replace the actual requested web page. The diagram below illustrates the flow of traffic and what happens when an inappropriate request is identified.

Pass-through/Firewall Mode

Most other Web filters must be deployed in line with network traffic. And, although the M86 WFR is capable of in-line placement, the nature of a pass-through deployment can create latency on outgoing requests; therefore, the WFR is rarely deployed this way. The benefit of pass-through deployment is that it forces all outgoing traffic to pass through the Web filter and thus be scanned and categorized. An additional downside is that if the Web filter goes down, the Internet traffic will be seriously impacted.

In the pass-through illustration below, Web traffic is unaffected by the caching proxy, regardless of whether the caching proxy is filtered or has cached pages that violate policy. This is because the WFR will stop any inappropriate requests from progressing beyond the point of the filter, so the caching server only returns web pages that have been approved by the WFR.

Appliance Models:

Small to midsize:

An affordable, single, integrated M86 Web Filter and Reporter appliance housed in rack-mountable 1U hardware. Supports up to 7,000 workstations

300 Series Appliances

500 Series Appliances

*When also receiving logs from the M86 SWG, maximum user count will be reduced.

Large:

One scalable, dedicated M86 Web Filter and a dedicated M86 Security Reporter appliance. Supports up to 30,000 workstations

700 Series Appliances

Documentation:

Download the M86 Web Filtering and Reporting Suite Datasheet (PDF).