URI - Match (UFP)

What can I do here?

Use this window to configure the UFP properties of the URI Resource.

Getting Here - Object Explorer > New > Resource > URI > General > Set URI match specification type to: UFP > "Match - UFP" page shows

UFP Servers

UFP servers are OPSEC certified third party applications that check URLs against a list of permitted categories to determine whether or not access to that URL should be allowed.

When a user requests a URL, the Security Gateway determines if the UFP server must be used. If a UFP server is used, the connection is held until the Firewall determines if the connection is permitted.

This window specifies how a connection is matched to the Resource in a rule. If a connection matches the source and destination of the rule and the match parameters of the Resource, then both the Action in the Rule and the Action in the Resource are applied.

UFP Options

General
- UFP server - select the server on which the UFP application is installed. The UFP server should already be defined as an OPSEC Application.
- UFP caching control - specifies if and how caching is to be enabled.

Caching Control	Description
UFP Server	The UFP server controls UFP caching. With this option the server will cache a URL and mask sent by the UFP server in a cache_info format.
Security Gateway (one request)	UFP caching is controlled by the gateway. This option disables the second, IP-based UFP request, increasing performance. With this option the security server caches the UFP server's reply to a CAT (category) request.
Security Gateway (two requests)	UFP caching is controlled by the gateway, and enables the second, IP-based UFP request, thereby increasing cache integrity. With this option the security server sends a second CAT (category) request with the IP address acting as the URL address, after receiving a reply from the first CAT request.
No caching	UFP caching disabled.

Categories - add categories to include in the resource definition.
Other
- Ignore UFP server after connection failure - means that the UFP server will be ignored after numerous UFP server connections were unsuccessful. The UFP server is ignored for a specific period of time, during which the rules in the Rule Base take over for the UFP server. At the end of the specified period of time the connection is attempted again.
- Number of failures before ignoring the UFP server - signifies at what point the UFP server should be ignored.
- Timeout before reconnect to UFP server - the amount of time that must pass before a UFP server connection should be attempted.