SSL Inspection
Secure Socket Layer (SSL) traffic, such as https://www.google.com/HTTPS, FTPs, POP3s, SMTPs, etc. is encrypted, and cannot be inspected using Security Service profiles such as App Patrol, Content Filter, Intrusion Prevention System (IPS), or Anti-Malware. The Zyxel Device uses SSL Inspection to decrypt SSL traffic, sends it to the Security Service engines for inspection, then encrypts traffic that passes inspection and forwards it to the destination server, such as Google.
Email security cannot be applied to traffic decrypted by SSL Inspection.• Use the Security Service > SSL Inspection > Profile screen (SSL Inspection Profile) to view SSL Inspection profiles. Click the Add or Edit icon in this screen to configure the CA certificate, action and log in an SSL Inspection profile.
• Use the Security Service > SSL Inspection > Exclude List screens (Exclude List Screen) to create a whitelist of destination servers to which traffic is passed through uninspected.
• Use the Security Service > SSL Inspection > Certificate Update screens (Certificate Update) to update the latest certificates of servers using SSL connections to the Zyxel Device network
What You Need To Know
SSL Inspection supports the following TLS protocols and encryption algorithms
• SSLv3 AES-CBC
• TLS1.0 AES-CBC
• TLS1.2 AES-CBC/AES-GCM
• TLS1.3 AES-GCM (no key update support nor 0-RTT)
• SSL Inspection does not support the following:
• Compression Support
• Client Authentication
Before You Begin
• If you don’t want to use the default Zyxel Device certificate, then create a new certificate in Object > Certificate > My Certificates.
• Decide what destination servers to which traffic is sent directly without inspection. This may be a matter of privacy and legality regarding inspecting an individual’s encrypted session, such as financial websites. This may vary by locale.
SSL Inspection Profile
An SSL Inspection profile is a template with pre-configured certificate, action and log.
The following table describes the fields in this screen.
label | Description |
|---|---|
General Settings | |
Server Signed Certificate Key Mode | With SSL inspection, the Zyxel Device acts as a 'man-in-the-middle' between a client and a remote server, when the client and server are communicating using an SSL-encrypted session. Every time the client and server send data to each other, the Zyxel Device decrypts the sender’s encrypted data, scans the plain data for threats, re-encrypts the data, and then sends the encrypted data to the receiver. • For outgoing sessions from the client to the remote server, the Zyxel Device creates a virtual server to decrypt data and a virtual client to re-encrypt data. • For incoming sessions from the remote server to the client, the Zyxel Device creates a virtual client to decrypt data, and a virtual server to re-encrypt data. To perform SSL Inspection for clients using SSL (HTTPS, SSH, SMTP) through the Zyxel Device, the Zyxel Device must check that the server’s certificate with corresponding public key are valid and were issued by a Certificate Authority (CA) listed in the Zyxel Device's list of trusted CAs. According to the selected key mode RSA 1024, RSA 2048, ECDSA-RSA-1024 or ECDSA-RSA-2048, the Zyxel Device will construct the corresponding self-signed certificate for the virtual server. RSA is a public-key cryptosystem used for data encryption or signing messages. For data encryption, the encryption key is public and the decryption key is private. For signing messages, the signing key is private and the verification key is public. Elliptic Curve Cryptography (ECC) is a public-key cryptosystem based on elliptic curve theory, and more efficient than RSA. ECC allows smaller keys compared to RSA to provide equivalent security. For example, a 224-bit elliptic curve public key should provide comparable security to a 2048-bit RSA public key. • ECDSA-RSA-1024 indicates Zyxel Device support for clients that support both ECDSA-256 and RSA-1024 with ECDSA-256 having higher priority, that is ECDSA-256 is used by the virtual server, if a client supports both ECDSA-256 and RSA-1024. • ECDSA-RSA-2048 indicates Zyxel Device support for clients that support both ECDSA-256 and RSA-2048 with ECDSA-256 having higher priority, that is ECDSA-256 is used by the virtual server, if a client supports both ECDSA-256 and RSA-2048. Select a mode that the client’s browser, FTP client, or mail client supports. The Zyxel Device will use different keys (cryptosystems) for each client according to the client’s support list. For example, if there are three clients behind a Zyxel Device with the following key mode support: • Client 1 - RSA-1024 • Client 2 - RSA-2048 and RSA-1024 • Client 3 - ECDSA-256 and RSA-2048. If you set the key mode to ECDSA-RSA-1024, then the following will be used by each client: • Client 1 - RSA-1024 • Client 2 - RSA-1024 • Client 3 - ECDSA-256. If you set the key mode to ECDSA-RSA-2048, then the following will be used by each client: • Client 1 - sessions will not be processed (pass) by SSL inspection • Client 2 - RSA-2048 • Client 3 - ECDSA-256. |
Profile Management | |
Add | Click Add to create a new profile. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
References | Select an entry and click References to open a screen that shows which settings use the entry.Click Refresh to update information on this screen. |
# | This is the entry’s index number in the list. |
Name | This displays the name of the profile. |
Description | This displays the description of the profile. |
CA Certificate | This displays the CA certificate being used in this profile. |
Reference | This displays the number of times an object reference is used in a profile. |
Action | Click this icon to apply the entry to a security policy. Go to the Configuration > Security Policy > Policy Control screen to check the result. |
Apply to a Security Policy
Click the icon in the Action field to apply the entry to a security policy.
Go to the Configuration > Security Policy > Policy Control screen to check the result.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Show Filter/Hide Filter | Click Show Filter to display IPv4 and IPv6 (if enabled) security policy search filters. |
IPv4 / IPv6 Configuration | Use IPv4 / IPv6 search filters to find specific IPv4 and IPv6 (if enabled) security policies based on direction, application, user, source, destination and/or schedule. |
From / To | Select a zone to view all security policies from a particular zone and/or to a particular zone. any means all zones. |
IPv4 / IPv6 Source | Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 source address object used. • An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. • An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. |
IPv4 / IPv6 Destination | Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 destination address object used. • An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. • An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. |
Service | View all security policies based the service object used. |
User | View all security policies based on user or user group object used. |
Schedule | View all security policies based on the schedule object used. |
Priority | This is the position of your Security Policy in the global policy list (including all through-Zyxel Device and to-Zyxel Device policies). The ordering of your policies is important as policies are applied in sequence. Default displays for the default Security Policy behavior that the Zyxel Device performs on traffic that does not match any other Security Policy. |
Status | This icon is lit when the entry is active and dimmed when the entry is inactive. |
Name | This is the name of the Security policy. |
From / To | This is the direction of travel of packets. Select from which zone the packets come and to which zone they go. Security Policies are grouped based on the direction of travel of packets to which they apply. For example, from LAN to LAN means packets traveling from a computer or subnet on the LAN to either another computer or subnet on the LAN. From any displays all the Security Policies for traffic going to the selected To Zone. To any displays all the Security Policies for traffic coming from the selected From Zone. From any to any displays all of the Security Policies. To ZyWALL policies are for traffic that is destined for the Zyxel Device and control which computers can manage the Zyxel Device. |
IPv4 / IPv6 Source | This displays the IPv4 / IPv6 source address object, including geographic address and FQDN (group) objects, to which this Security Policy applies. |
IPv4 / IPv6 Destination | This displays the IPv4 / IPv6 destination address object, including geographic address and FQDN (group) objects, to which this Security Policy applies. |
Service | This displays the service object to which this Security Policy applies. |
User | This is the user name or user group name to which this Security Policy applies. |
Schedule | This field tells you the schedule object that the policy uses. none means the policy is active at all times if enabled. |
Action | This field displays whether the Security Policy silently discards packets without notification (deny), permits the passage of packets (allow) or drops packets with notification (reject) |
Log | Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or not (no) when the policy is matched to the criteria listed above. |
Profile | This field shows you which Security Service profiles (application patrol, content filter, IPS, anti-malware, email security) apply to this Security policy. Click an applied Security Service profile icon to edit the profile directly. |
OK | Click OK to save your changes back to the Zyxel Device. |
Cancel | Click Cancel to exit this screen without saving. |
Add / Edit SSL Inspection Profiles
The following table describes the fields in this screen.
LABEL | Description |
|---|---|
Name | This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names: • MyProfile • mYProfile • Mymy12_3-4 These are invalid profile names: • 1mYProfile • My Profile • MyProfile? • Whatalongprofilename123456789012 |
Description | Enter additional information about this SSL Inspection entry. You can enter up to 60 characters ("0-9", "a-z", "A-Z", "-" and "_"). |
CA Certificate | This contains the default certificate and the certificates created in Object > Certificate > My Certificates. Choose the certificate for this profile. |
SSL/TLS version supported minimum | SSL / TLS connections using versions lower than this setting are blocked. |
Log | These are the log options for unsupported traffic that matches traffic bound to this policy: • no: Select this option to have the Zyxel Device create no log for unsupported traffic that matches traffic bound to this policy. • log: Select this option to have the Zyxel Device create a log for unsupported traffic that matches traffic bound to this policy • log alert: An alert is an emailed log for more serious events that may need more immediate attention. They also appear in red in the Monitor > Log screen. Select this option to have the Zyxel Device send an alert for unsupported traffic that matches traffic bound to this policy. |
Action for Connection with unsupported suit | SSL Inspection supports these cipher suites: • DES • 3DES • AES Select to pass or block unsupported traffic (such as other cipher suites, compressed traffic, client authentication requests, and so on) that matches traffic bound to this policy here. |
Log | These are the log options for unsupported traffic that matches traffic bound to this policy: • no: Select this option to have the Zyxel Device create no log for unsupported traffic that matches traffic bound to this policy. • log: Select this option to have the Zyxel Device create a log for unsupported traffic that matches traffic bound to this policy • log alert: An alert is an emailed log for more serious events that may need more immediate attention. They also appear in red in the Monitor > Log screen. Select this option to have the Zyxel Device send an alert for unsupported traffic that matches traffic bound to this policy. |
Action for connection with untrusted cert chain | A certificate chain is a certification process that involves the following certificates between the SSL/TLS server and a client. A certificate chain will fail if one of the following certificates is not correct. • A certificate owned by a user • The certificate signed by a certification authority • A root certificate Select to pass, inspect, or block an untrusted certification chain. |
Log | These are the log options for unsupported traffic that matches traffic bound to this policy: • no: Select this option to have the Zyxel Device create no log for unsupported traffic that matches traffic bound to this policy. • log: Select this option to have the Zyxel Device create a log for unsupported traffic that matches traffic bound to this policy • log alert: An alert is an emailed log for more serious events that may need more immediate attention. They also appear in red in the Monitor > Log screen. Select this option to have the Zyxel Device send an alert for unsupported traffic that matches traffic bound to this policy. |
OK | Click OK to save your settings to the Zyxel Device, and return to the profile summary page. |
Cancel | Click Cancel to return to the profile summary page without saving any changes. |
Exclude List Screen
There may be privacy and legality issues regarding inspecting a user's encrypted session. The legal issues may vary by locale, so it's important to check with your legal department to make sure that it’s OK to intercept SSL traffic from your Zyxel Device users.
To ensure individual privacy and meet legal requirements, you can configure an exclusion list to exclude matching sessions to destination servers. This traffic is not intercepted and is passed through uninspected.
The following table describes the fields in this screen.
LABEL | Description |
|---|---|
General Settings | |
Enable Logs for Exclude List | Click this to create a log for traffic that bypasses SSL Inspection. |
Exclude List Address Settings | Use this part of the screen to create, edit, or delete items in the SSL Inspection exclusion list. |
Add | Click this to create a new entry. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
# | This is the entry’s index number in the list. |
Exclude List of Certificate Identity | SSL traffic to a server to be excluded from SSL Inspection is identified by its certificate. Identify the certificate in one of the following ways: • The Common Name (CN) of the certificate. The common name of the certificate can be created in the Object > Certificate > My Certificates screen. • Type an IPv4 or IPv6 address. For example, type 192.168.1.35, or 2001:7300:3500::1 • Type an IPv4/IPv6 in CIDR notation. For example, type 192.168.1.1/24, or 2001:7300:3500::1/64 • Type an IPv4/IPv6 address range. For example, type 192.168.1.1-192.168.1.35, or 2001:7300:3500::1-2001:7300:3500::35 • Type an email address. For example, type abc@zyxel.com.tw • Type a DNS name or a common name (wildcard char: '*', escape char: '\'). Use up to 127 case-insensitive characters (0-9a-zA-Z`~!@#$%^&*()-_=+[]{}\|;:',.<>/?). ‘*’ can be used as a wildcard to match any string. Use ‘\*’ to indicate a single wildcard character. Alternatively, to automatically add an entry for existing SSL traffic to a destination server, go to Monitor > Security Statistics > SSL Inspection > Certificate Cache List, select an item and then click Add to Exclude List. The item will then appear here. |
Exclude List Web Category Settings | Use this section to let SSL traffic destined for websites in the selected web categories to pass through the Zyxel Device without been inspected. |
Select All Categories | Select this to allow SSL traffic to all sites belonging to the categories below pass through without been inspected. |
Clear All Categories | Select this to clear the selected categories below. The Zyxel Device will inspect SSL traffic going to all web pages unless the destination servers are excluded in Exclude List Address Settings. |
Managed Categories | These are categories of web pages based on their content. For example, a web page that sells wine will be classified as the Alcohol category. Select categories in this section to allow traffic to specific types of Internet content pass through without been intercepted. You must have the Category Service Web Filtering license to filter these categories. See the next table for category details. |
Apply | Click Apply to save your settings to the Zyxel Device. |
Reset | Click Reset to return to the profile summary page without saving any changes. |
The following table describes the managed categories.
category | description |
|---|---|
Adult Topics | Web pages that contain content or themes that are generally considered unsuitable for children. |
Alcohol | Web pages that mainly sell, promote, or advocate the use of alcohol, such as beer, wine, and liquor. This category also includes cocktail recipes and home-brewing instructions. |
Anonymizing Utilities | Web pages that result in anonymous web browsing without the explicit intent to provide such a service. This category includes URL translators, web-page caching, and other utilities that might function as anonymizers, but without the express purpose of bypassing filtering software. This category does not include text translation. |
Art Culture Heritage | Web pages that contain virtual art galleries, artist sites (including sculpture and photography), museums, ethnic customs, and country customs. This category does not include online photograph albums. |
Auctions Classifieds | Web pages that provide online bidding and selling of items or services. This category includes web pages that focus on bidding and sales. This category does not include classified advertisements such as real estate postings, personal ads, or companies marketing their auctions. |
Blogs/Wiki | Web pages containing dynamic content, which often changes because users can post or edit content at any time. This category covers the risks with dynamic content that might range from harmless to offensive. |
Business | Web pages that provide business-related information, such as corporate overviews or business planning and strategies. This category also includes information, services, or products that help other businesses plan, manage, and market their enterprises, and multi-level marketing. This category does not include personal pages and web-hosting web pages. |
Chat | Web pages that provide web-based, real-time social messaging in public and private chat rooms. This category includes IRC. This category does not include instant messaging. |
Computing Internet | Web pages containing reviews, information, buyer's guides of computers, computer parts and accessories, computer software and internet companies, industry news and magazines, and pay-to-surf sites. |
Consumer Protection | Websites that try to rob or cheat consumers. Some examples of their activities include selling counterfeit products, selling products that were originally provided for free, or improperly using the brand of another company. This category also includes sites where many consumers reported being cheated or not receiving services. This category does not include phishing, which tries to perpetrate fraud or theft by stealing account information. To check for phishing, go to Security Service > Reputation Filter > IP Reputation and select Phishing. |
Content Server | URLs for servers that host images, media files, or JavaScript for one or more sites and are intended to speed up content retrieval for existing web servers, such as Apache. This category includes domain-level and sub-domain-level URLs that function as content servers. This category does not include: • Web pages for businesses that provide the content servers • Web pages that allow users to browse photographs. See the Media Sharing category. • URLs for servers that serve only advertisements. See the Web Ads category. |
Controversial Opinions | Web pages that contain opinions that are likely to offend political or social sensibilities and incite controversy. Much of this content is at the extremes of public opinion. This category does not include opinion or language clearly intended to promote hate or discrimination. |
Cult Occult | Sites relating to non-traditional religious practices considered to be false, unorthodox, extremist, or coercive. |
Dating Personals | Web pages that provide networking for online dating, matchmaking, escort services, or introductions to potential spouses. This category does not include sites that provide social networking that might include dating, but are not specific to dating. |
Dating Social Networking | Web pages that focus on social interaction such as online dating, friendship, school reunions, pen-pals, escort services, or introductions to potential spouses. This category does not include wedding-related content, dating tips, or related marketing. |
Digital Postcards | Web pages that allow people to send and receive digital postcards and greeting cards via the Internet. |
Discrimination | Web pages, which provide information that explicitly encourages the oppression or discrimination of a specific group of individuals. This category does not include jokes and humor, unless the focus of the entire site is considered discriminatory. |
Drugs | Websites that provide information on the purchase, manufacture, and use of illegal or recreational drugs. This category does not include sites with exclusive health or political themes. |
Education Reference | Web pages devoted to academic-related content such as academic subjects (mathematics, history), school or university web pages, and education administration pages (school boards, teacher curriculum). |
Entertainment | Web pages that provide information about cinema, theater, music, television, infotainment, entertainment industry gossip-news, and sites about celebrities such as actors and musicians. This category also includes sites where the content is devoted to providing entertainment on the web, such as horoscopes or fan clubs. |
Extreme | Web pages that provide content considered gory, perverse, or horrific. |
Fashion Beauty | Web pages that market clothing, cosmetics, jewelry, and other fashion-oriented products, accessories, or services. This category also includes product reviews, comparisons, and general consumer information, and services such as hair salons, tanning salons, tattoo studios, and body-piercing studios. This category does not include fashion-related content such as modeling or celebrity fashion unless the site focuses on marketing the product line. |
Finance Banking | Web pages that provide financial information or access to online financial accounts. This category includes stock information (but not stock trading), home finance, and government-related financial information. |
For Kids | Web pages that are family-safe, specifically for children of approximate ages ten and under. This category can also be used as an exception to allow web pages that do not pose a risk to children, or to access sites that have a primary educational or recreational focus for children, but are in other categories such as Games, Humor/Comics, Recreation/Hobbies, or Entertainment. |
Forum Bulletin Boards | Web pages that provide access (http://) to Usenet newsgroups or hold discussions and post user-generated content, such as real-time message posting for an interest group. This category also includes archives of files uploaded to newsgroups. This category does not include message forums with a business or technical support focus. |
Gambling | Web pages that allow users to wager or place bets online, or provide gambling software that allows online betting, such as casino games, betting pools, sports betting, and lotteries. This category does not include web pages related to gambling that do not allow betting online. |
Gambling Related | Web pages that offer information about gambling, without providing the means to gamble. This category includes casino-related web pages that do not offer online gambling, gambling links, tips, sports picks, lottery results, and horse, car, or boat racing. |
Game Cartoon Violence | Web pages that provide fantasy or fictitious representations of violence within the context of games, comics, cartoons, or graphic novels. This category includes images and textual descriptions of physical assaults or hand-to-hand combat, and grave injury and destruction caused by weapons or explosives. |
Games | Web pages that offer online games and related information such as cheats, codes, demos, emulators, online contests or role-playing games, gaming clans, game manufacturer sites, fantasy or virtual sports leagues, and other gaming sites without chances of profit. This category includes gaming consoles. |
General News | Web pages that provide online news media, such as international or regional news broadcasting and publication. This category includes portal sites that provide news content. |
Government Military | Web pages that contain content maintained by governmental or military organizations, such as government branches or agencies, police departments, fire departments, civil defense, counter-terrorism organizations, or supranational organizations, such as the United Nations or the European Union. This category includes military and veterans’ medical facilities. |
Gruesome Content | Web pages with content that can be considered tasteless, gross, shocking, or gruesome. This category does not include web pages with content pertaining to physical assault. |
Health | Web pages that cover all health-related information and health care services. This category does not include cosmetic surgery, marketing/selling pharmaceuticals, or animal-related medical services. |
Historical Revisionism | Web pages that denounce, or offer different interpretations of, significant historical facts, such as holocaust denial. This category does not include all re-examination of historical facts, only historical events that are highly sensitive. |
History | Web pages that provide content about historical facts. This category includes content suitable for higher education, but the Education category includes content for primary education. For example, a site with Holocaust photographs might be offensive, but have academic value. |
Humor Comics | Web pages that provide comical or funny content. This category includes sites with jokes, sketches, comics, and satire pages. This category might also include graphic novel content, which is often associated with comics. |
Illegal UK | Web pages that contain child sexual abuse content hosted anywhere in the world, and criminally obscene and incitement to racial hatred content hosted in the UK. |
Incidental Nudity | Web pages that contain non-pornographic images of the bare human body like those in classic sculpture and paintings, or medical images. This category enables you to allow or block sites in order to address cultural or geographic differences in opinion about nudity. For example, you can use this category to block access to nudity, but allow access when nudity is not the primary focus of a site, such as news sites or major portals. |
Information Security | Web pages that legitimately provide information about data protection. This category includes detailed information for safeguarding business or personal data, intellectual property, privacy, and infrastructure on the Internet, private networks, or in other bandwidth services such as telecommunications. This category does not include: • Legitimate information security companies and security software providers, such as virus protection companies. • Sites that intend to exploit security or teach how to bypass security. |
Information Security New | Web pages that legitimately provide information about data protection. This category includes detailed information for safeguarding business or personal data, intellectual property, privacy, and infrastructure on the Internet, private networks, or in other bandwidth services such as telecommunications. This category does not include: • Legitimate information security companies and security software providers, such as virus protection companies. • Sites that intend to exploit security or teach how to bypass security. |
Instant Messaging | Web pages that provide software for real-time communication over a network exclusively for users who joined a member’s contact list or an instant-messaging session. Most instant-messaging software includes features such as file transfer, PC-to-PC phone calls, and can track when other people log on and off. |
Interactive Web Applications | Web pages that provide access to live or interactive web applications, such as browser-based office suites and groupware. This category includes sites with business, academic, or individual focus. This category does not include sites providing access to interactive web applications that do not take critical user data or offer security risks, such as Google Maps. |
Internet Radio TV | Web pages that provide software or access to continuous audio or video broadcasting, such as Internet radio, TV programming, or podcasting. Quick downloads and shorter streams that consume less bandwidth are in the Streaming Media or Media Downloads categories. |
Internet Services | Web pages that provide services for publication and maintenance of Internet sites such as web design, domain registration, Internet Service Providers, and broadband and telecommunications companies that provide web services. This category includes web utilities such as statistics and access logs, and web graphics like clip art. |
Job Search | Web pages related to a job search including sites concerned with resume writing, interviewing, changing careers, classified advertising, and large job databases. This category also includes corporate web pages that list job openings, salary comparison sites, temporary employment, and company job-posting sites. This category does not include make-money-at-home sites. |
Major Global Religions | Web pages with content about religious topics and information related to major religions. This category includes sites that cover religious content such as discussion, beliefs, non-controversial commentary, articles, and information for local congregations such as a church or synagogue homepage. The religions in this category are Baha'i, Buddhism, Chinese Traditional, Christianity, Hinduism, Islam, Jainism, Judaism, Shinto, Sikhism, Tenrikyo, Zoroastrianism. |
Marketing Merchandising | Web pages that promote individual or business products or services on the web, but do not sell their products or services online. This category includes websites that are generally a company overview, describing services or products that cannot be purchased directly from these sites. Examples include automobile manufacturer sites, wedding photography services, or graphic design services. This category does not include: • Other categories that imply marketing such as Alcohol, Auctions/Classifieds, Drugs, Finance/Banking, Mobile Phone, Online Shopping, Real Estate, School Cheating Information, Software/Hardware, Stock Trading, Tobacco, Travel, and Weapons. • Sites that market their services only to other businesses. See the Business category. • Sites that rob or cheat consumers. See the Consumer Protection category. |
Media Downloads | Web pages that provide audio or video files for download such as MP3, WAV, AVI, and MPEG formats. The files are saved to, and played from, the user’s computer. This category does not include audio or video files that are played directly through a browser window. See the Streaming Media category. |
Media Sharing | Web pages that allow users to upload, search for, and share media files and photographs, such as online photograph albums. |
Messaging | Examples include text messaging to mobile phones, PDAs, fax machines, and internal website user-to-user messaging or site-to-site messaging. This category does not include real-time chat or instant messaging, or message posts that can be viewed by anyone but the intended recipient. |
Mobile Phone | Web pages that sell media, software, or utilities for mobile phones that can be downloaded and delivered to mobile phones. Examples include ringtones, logos/skins, games, screen-savers, text-based tunes, and software for SMS, MMS, WAP, and other mobile phone protocols. |
Moderated | Bulletin boards, chat rooms, search engines, or web mail sites that are monitored by an individual or group who has the authority to block messages or content considered inappropriate. This category does not include sites with posted rules against offensive content. See the Forum/Bulletin Boards category. |
Motor Vehicles | Websites for manufacturers and dealerships of consumer transportation vehicles, such as cars, vans, trucks, SUVs, motorcycles, and scooters. This category also includes sites that provide product marketing, reviews, comparisons, pricing information, auto fairs, auto expos, and general consumer information about motor vehicles. This category does not include automotive accessories, mechanics, auto-body shops, and recreational hobby pages. This category does not include sites that provide business-to-business-only content regarding motor vehicles. |
Non Profit Advocacy NGO | Web pages from charitable or educational groups that fulfill a stated mission, benefiting the larger community, such as clubs, lobbies, communities, non-profit organizations, labor unions, and advocacy groups. Examples are Masons, Elks, Boy and Girl Scouts, or Big Brothers. |
Nudity | Web pages that have non-pornographic images of the bare human body. This category includes classic sculpture and paintings, artistic nude photographs, some naturism pictures, and detailed medical illustrations. This category does not include high-profile sites where nudity is not a concern for visitors. See the Incidental Nudity category. |
Online Shopping | Web pages that sell products or services online. Web pages selling a broad range of products might pose a risk to users by offering access to items that are normally in other categories such as Pornography, Weapons, Nudity, or Violence. Web pages selling such content exclusively are in their respective categories. |
P2P File Sharing | Web pages that allow the exchange of files between computers and users for business or personal use, such as downloadable music. P2P clients allow users to search for and exchange files from a peer-user network. They often include spyware or real-time chat capabilities. This category includes BitTorrent web pages. |
Parked Domain | Web pages that once served content, but their domains have been sold or abandoned and are no longer registered. Parked domains do not host their own content, but usually redirect users to a generic page that states the domain name is for sale, or redirect users to a generic search engine and portal page, some of which provide valid search engine results. |
Personal Network Storage | Web pages that allow users to upload folders and files to an online network server in order to backup, share, edit, or retrieve files or folders from any web browser. |
Personal Pages | Personal home pages that share a common domain such as those hosted by ISPs, university/education servers, or free web page hosts. This category also includes unique domains that contain personal information, such as a personal home page. This category does not include home pages of public figures. |
Pharmacy | Web pages that provide reviews, descriptions, and market or sell prescription-based drugs, over-the-counter drugs, birth control, or dietary supplements. |
Politics Opinion | Web pages covering political parties, individuals in political life, and opinion on various topics. This category might also cover laws and political opinion about drugs. This category includes URLs for political parties, political campaigning, and opinions on various topics, including political debates. |
Pornography | Web pages that contain materials intended to be sexually arousing or erotic. This category includes fetish pages, animation, cartoons, stories, and illegal pornography. |
Portal Sites | Web pages that serve as major gateways or directories to content on the web. Many portal sites also provide a variety of internal site features or services such as search engines, email, news, and entertainment. Mailing list sites with a variety of content are in this category. This category does not include sites with topic-specific content. |
Potential Criminal Activities | Web pages that provide instructions to commit illegal or criminal activities. Instructions include committing murder or suicide, sabotage, bomb-making, lock-picking, service theft, evading law enforcement, or spoofing drug tests. This category might also include information on how to distribute illegal content, perpetrate fraud, or consumer scams. This category does not include computer-related fraud. |
Potential Hacking Computer Crime | Web pages that provide instructions, or otherwise enable, fraud, crime, or malicious activity that is computer-oriented. This category includes web pages related to computer crime include malicious hacking information or tools that help individuals gain unauthorized access to computers and networks (root kits, kiddy scripts). This category also includes other areas of electronic fraud such as dialer scams and illegal manipulation of electronic devices. This category does not include illegal software. |
Potential Illegal Software | Web pages, which the filter believes offer information to potentially ‘pirated’ or illegally distribute software or electronic media, such as copyrighted music or film, distribution of illegal license key generators, software cracks, and serial numbers. This category does not include peer-to-peer web pages. |
Private IP Addresses | Sites that are private IP addresses as defined in RFC 1918, that is, hosts that do not require access to hosts in other enterprises (or require just limited access) and whose IP address may be ambiguous between enterprises but are well defined within a certain enterprise. |
Profanity | Web pages that contain crude, vulgar, or obscene language or gestures. |
Professional Networking | Web pages that provide social networking exclusively for professional or business purposes. This category includes sites that provide personal or group profiles, and enable their members to interact through real-time communication, message posting, public bulletins, and media sharing. This category also contains alumni sites that have a networking function. This category does not include social networking sites where the focus might vary, but include friendship, dating, or professional focuses. |
Provocative Attire | Web pages with pictures that include alluring or revealing attire, lingerie and swimsuits, or supermodel or celebrity photograph collections, but do not involve nudity. This category does not include sites with swimwear or similar attire that is not intended to be provocative. For example, Olympic swimming sites are not in this category. |
Public Information | Web pages that provide general reference information such as public service providers, regional information, transportation schedules, maps, or weather reports. |
PUPs | Web pages that contain Potentially Unwanted Programs (PUPs). PUPs are often made for a beneficial purpose but they alter the security of a computer or the computer user’s privacy. Computer users who are concerned about security or privacy might want to be informed about this software, and in some cases, they might want to remove this software from their computers. |
Real Estate | Web pages that provide commercial or residential real estate services and information. Service and information includes sales and rental of living space or retail space and guides for apartments, housing, and property, and information on appraisal and brokerage. This category includes sites that allow you to browse model homes. This category does not include content related to personal finance, such as credit applications. |
Recreation Hobbies | Web pages for recreational organizations and facilities that include content devoted to recreational activities and hobbies. This category includes information about public swimming pools, zoos, fairs, festivals, amusement parks, recreation guides, hiking, fishing, bird watching, or stamp collecting. This category does not include activities that need no active participation, such as watching a movie or reading celebrity gossip. |
Religion Ideology | Web pages with content related to religious topics and beliefs in human spirituality that are not within the major religions. This category includes religious discussion, beliefs, articles, and information for local congregations or groups such as a church homepage, unless the site is already in the Major Global Religions category. This category also includes comparative religion, or sites that include religions and ideologies. This category does not include astrology and horoscope sites |
Remote Access | Web pages that provide remote access to a program, online service, or an entire computer system. Although remote access is often used legitimately to run a computer from a remote location, it creates a security risk, such as backdoor access. Backdoor access, written by the original programmer, allows the system to be controlled by another party without the user's knowledge. |
Reserved | This category is reserved for future use. |
Residential IP Addresses | IP addresses (and any domains associated with them) that access the Internet by DSL modems or cable modems. Because this content is not generally intended for Internet access via HTTP, access to the Internet through these IP addresses can indicate suspicious behavior. This behavior might be related to malware located on the home computer or homegrown gateways set up to allow anonymous Internet access. |
Resource Sharing | Web pages that harness idle or unused computer resources to focus on a common task. The task can be on a company or an international basis. Well known examples are the SETI program and the Human Genome Project, which use the idle time of thousands of volunteered computers to analyze data. |
Restaurants | Web pages that provide information about restaurants, bars, catering, take-out and delivery, including online ordering. This category includes sites that provide information about location, hours, prices, menus and related dietary information. This category also includes restaurant guides and reviews, and cafes and coffee shops. This category does not include groceries, wholesale food, non-profit and charitable food organizations, or bars that do not focus on serving food. |
School Cheating Information | Web pages that promote plagiarism or cheating by providing free or fee-based term papers, written essays, or exam answers. This category does not include sites that offer student help, discuss literature, films, or books, or other content that is often the subject of research papers. |
Search Engines | Web pages that provide search results that enable users to find information on the Internet based on key words. This category does not include site-specific search engines. |
Sexual Materials | Web pages that describe or depict sexual acts, but are not intended to be arousing or erotic. Examples of sexual materials include sex education, sexual innuendo, humor, or sex related merchandise. This category does not include web pages with content intended to arouse. |
Shareware Freeware | Web pages that are repositories of downloadable copies of shareware and freeware. This category does not include subscription-based software. |
Social Networking | Web pages that enable social networking for a variety of purposes, such as friendship, dating, professional, or topics of interest. These sites provide personal or group profiles and enable interaction among their members through real-time communication, message posting, public bulletins, and media sharing. This category does not include sites that are exclusive to dating, matchmaking, or a specific professional networking focus. |
Software Hardware | Web pages related to computing software and hardware, including vendors, product marketing and reviews, deployment and maintenance of software and hardware, and software updates and add-ons such as scripts, plug-ins, or drivers. Hardware includes computer parts, accessories, and electronic equipment used with computers and networks. This category includes the marketing of software and hardware, and magazines focused on software or hardware product reviews or industry trends. |
Sports | Web pages related to professional or organized recreational sports. This category includes sporting news, events, and information such as playing tips, strategies, game scores, or player trades. This category does not include fantasy leagues, sports centers, athletic clubs, fitness or martial arts clubs, and non-league billiards, darts, or other such activities. |
Stock Trading | Web pages that offer purchasing, selling, or trading of shares online. This category also includes ticker-tape information that enables viewing of real-time stock prices and financial spread betting in the stock market. Other betting is in the Gambling category. This category does not include sites that offer information about stocks, but do not offer purchasing, selling, or trading of shares. |
Streaming Media | Web pages that provide streaming media, or contain software plug-ins for displaying audio and visual data before the entire file has been transmitted. This category does not include audio or video files that are downloaded to a user’s computer before being played. |
Technical Business Forums | Web pages with a technical or business focus that provide online message posting or real-time chatting, such as technical support or interactive business communication. Although users can post any type of content, these forums tend to present less risk of containing offensive content. Sites that offer a variety of forums with themes, including technical and business content, are only in the categories of Forum/Bulletin Boards or Chat. |
Technical Information | Web pages that provide computing information with an educational focus in areas such as Information Technology, computer programming, and certification. Examples include Linux user groups, UNIX commands, software tutorials, or dictionaries of technical terms. Most sites in this category might be subdirectories of larger domains. For example, a software site with a tutorial page is in this category only at the tutorial page URL. This category does not include content about information security. |
Text Spoken Only | Content that is text or audio only, and does not contain pictures. This category can be used as an exception to allow explicit text and recorded material to be accessed when you want pictures blocked using the Pornography, Violence, or Sexual Materials categories. Libraries or universities can use this category to prevent the display of offensive graphics in their public facilities. |
Text Translators | Web pages that allow users to type phrases or a block of text to translate it from one language into another. This category also includes language identifier web pages. URL translation is in the Anonymizing Utilities category. |
Tobacco | Web pages that sell, promote, or advocate the use of tobacco products, tobacco paraphernalia, including cigarettes, cigars, pipes, snuff and chewing tobacco. |
Travel | Web pages that promote personal or business travel, such as hotels, resorts, airlines, ground transportation, car rentals, travel agencies, and general tourist and travel information. This category also includes sites for buying tickets or accommodation. This category does not include personal vacation photographs. |
Usenet News | Web pages that provide access (http://) to Usenet newsgroups and archives of files uploaded to newsgroups. This category also includes online groups that offer similar community-oriented content posting. |
Violence | Web pages that contain real or lifelike images or text that portray, describe, or advocate physical assaults against people, animals, or institutions, such as depictions of war, suicide, mutilation, or dismemberment. |
Visual Search Engine | Web pages that provide image-specific search results such as thumbnail pictures. This category does not include sites that offer site-specific visual search engines. |
Weapons | Web pages that provide information about buying, making, modifying, or using weapons, such as guns, knives, swords, paintball guns, and ammunition, explosives, and weapon accessories. This category also includes sites that contain content for: weapons for personal or military use, homemade weapons, non-lethal weapons such as mace, pepper spray, or Taser guns, weapons facilities, such as shooting ranges, and government or military oriented weapons. This category does not include political action groups, such as the NRA. |
Web Ads | Web pages that provide advertisement-hosting or programs that create advertisements. Examples include links, source code or applets for banners, popups, and other kinds of static or dynamically generated advertisements that appear on web pages. This category is intended to block advertisements on web pages, not the companies that provide the advertisements or advertising services. This category does not include aggressive advertising adware. See the Spyware/Adware category. |
Web Mail | Web pages that enable users to send or receive email through the Internet. |
Web Meetings | Web pages that host live meetings, video conferences, and interactive presentations mainly for businesses. Web meetings generally include streaming audio and video, and allow data transfer or office-oriented application sharing, such as online presentations. |
Web Phone | Web pages that enable users to make telephone calls via the Internet or obtain information or software for this purpose. Web Phone service is also called Internet Telephony, or VoIP. Web phone service includes PC-to-PC, PC-to-phone, and phone-to-phone services connecting via TCP/IP networks. |
Certificate Update
Use this screen to update the latest certificates of servers using SSL connections to the Zyxel Device network.
The following table describes the fields in this screen.
LABEL | Description |
|---|---|
Certificate Information | |
Current Version | This displays the current certificate set version. |
Released Date | This field displays the date and time the current certificate set was released. |
Certificate Update | You should have Internet access and have activated SSL Inspection on the Zyxel Device at myZyxel. |
Update Now | Click this button to download the latest certificate set (Windows, MAC OS X, and Android) from the Zyxel cloud server and update it on the Zyxel Device. |
Auto Update | Select this to automatically have the Zyxel Device update the certificate set when a new one becomes available on the Zyxel cloud sever. |
Apply | Click Apply to save your settings to the Zyxel Device. |
Reset | Click Reset to return to the profile summary page without saving any changes. |