| This control requires that identified traffic destined for certain external networks be inspected before being allowed through externally facing interfaces. The network device must support logging individual Transmission Control Protocol (TCP) sessions. It must also support blocking or restricting based on, at a minimum, Uniform Resource Locators (URLs), domain names, IP addresses or IP ranges, and lists of authorized or unauthorized websites.
Not all network traffic or applications are required to be directed to an application network device or other proxy-type service. With an application network device or proxy-type service acting as the intermediary, the client does not interact directly with external networks or servers. However, when dedicated application network devices or proxy-type services are available, routing services on the client or network must be configured to forward traffic to the appropriate server or service before the traffic is allowed though the outbound perimeter network device or router interfaces.
To comply with this policy, the network device must include application network devices or other proxy-type devices with application awareness. These devices allow or disallow traffic based on an examination of traffic content. This type of content filtering is most effective when placed logically close to the internal boundary where the traffic is being generated, thus a distributed network device architecture which includes a combination of the following content filtering devices or services is often necessary: packet and deep packet inspection network device; application network device/gateway; proxy service or proxy server; Web or SSL application network device/gateway; and Network Address Translation (NAT) server or service. The network device must support logging individual TCP sessions and blocking specific URLs, domain names, and IP addresses, and lists of authorized and unauthorized websites.
This requirement is applicable to specific devices and does not involve the management of a network device. |
