by
Etienne Liebetrau
A frequently requested feature of the Sophos XG product is the ability to recategorize a website from the default category to another. At this time, it is not possible to re-assign a site from one category to another, but you can create custom categories and use those instead.
You can use custom categories not only for recategorizing websites in Sophos XG, but also for allowing or denying access to specific sites for certain users. They can also be used to reclassify the browsing 'productivity' for certain users when viewing Internet usage reports in Fastvue Sophos Reporter. For example, you can use them to classify lingerie sites as 'productive' for people in a retail lingerie department or to classify social media sites as 'productive' for people in the marketing department.
There are a couple of "gotchas" in doing this, and I will explain how to avoid them while taking you through the process.
For this article, assume we are a retail chain that sells swimwear and lingerie.
To figure out where sites are categorized by default, we use the URL Category Lookup tool.
Here are some example sites and the URL category they return using the URL Category Lookup tool.
The default categorization is clearly not going to work for us. Swimwear is mis-categorized twice (once as General Business, and once as Online Shopping), and when these sites are correctly identified, Swimwear and Lingerie are grouped together, rather than two separate categories. We therefore need to recategorize these websites in Sophos XG.
As mentioned, recategorizing websites in Sophos XG is done using by creating custom URL categories:
Let's check that the new categories are being recognized using the URL Category Lookup tool:
You can now see that two categories show up. The top one is the custom URL Category and the bottom one is the default URL Category.
Now let's check the firewall policy.
We can see that the site is still being blocked based on the default URL category in the web policy. It is as if the new custom URL Category is not being recognized.
Let's repeat the test but this time, let's use the Test Web Policy method**.**
We can see that the site is still being blocked based on the default URL category in the web policy.
Let's repeat the test again, but this time we'll test the Allow All Web Policy.
In this case, you can see that it will be allowed, and more importantly that the category is now picking up the custom URL Category we defined in Sophos XG.
As we can see from the tests, the web policies are still blocking the site based on the default URL category. To fix this we need to edit the relevant rules in the web policies to allow the custom URL category, but only for the users that need to access those sites.
It is important to add the rules above the deny action. If it is below, the default URL categorization will be applied and the site will be blocked.
Let's repeat the policy tests for www.victoriassecret.com:
Success.
The last step is to add our custom URL categories into the correct productivity list in Fastvue Sophos Reporter.
Once some traffic has passed to the sites in question, the custom URL categories will show up in Fastvue Sophos Reporter's Unassigned Productivity list.
Now when users in the Lingerie or Swimwear departments browse lingerie or swimwear websites, no longer will Fastvue Reporter show their browsing in the Unproductive or Unacceptable browsing reports or alerts!
You can follow the same process to allow your Marketing department to Social Media websites and classify their browsing as productive.
Recategorizing websites in Sophos XG is relatively simple. You can use this method to allow or deny access to certain websites for specific users, and change the productivity of those sites in Fastvue Sophos Reporter when the allowed users access those sites. Using categories instead of URL groups keeps productivity reporting simple.
Meanwhile, browsing by other users to swimwear and lingerie websites will still be categorized as the default 'Swimwear and Lingerie' category, and their browsing will be reported as Unproductive in Fastvue Sophos Reporter.
Haven't tried Fastvue Sophos Reporter yet? Download the free 30-day.
Download our FREE 30-day trial, or schedule a demo and we'll show you how it works.
Sophos XG Reporting Now Available in Fastvue Sophos Reporter!
How to Enable Dark Mode in Fortinet FortiGate (FortiOS 7.0)