Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
823 Views 5 Replies Latest reply: Feb 3, 2014 5:08 AM by nathan.tlou RSS
wajeeh_r Newcomer 40 posts since
Feb 16, 2013
Currently Being Moderated

Jul 9, 2013 2:30 PM

Allow sites which are getting blocked 'media type not detected'

Dear All,

 

We have web gateway appliances with 7.3.2. I have a rule 'media type not detected and action is block page', Now there are certain sites which we know are trustable and they also do not fall under URL categories which we have blocked but we are facing disturbance for them as they are getting blocked with message ' Media Type not detected', my intension is to keep the media type rule enabled but at the same need to workout a solution to allow certain those sites which we think are ok but they are presently getting blocked with media type rule.

 

Please advise how to tell media type rule that those sites are ok. Please note I also want to keep the rule enabled so any media type really unwanted should remain blocked.

 

the two sites are:

www.hamariweb.com, i checked it on trustedsource.org and it falls under portal sites (not a URL blocked category at our company)

http://eservices.wmn.gov.sa:8081/eservices/ittikaf/reg_seasonal_isolated.php, I checked this also falls under government sites (not a URL blocked category at our company)

 

but the two should not be blocked with 'media type rule'

 

Kindly help...

  • Jon Scholten McAfee SME 857 posts since
    Nov 3, 2009

    Could you please post details about the rule? I can imagine what it looks like, but would like to see it.

     

    (this doesnt sound like a good idea btw...)

     

    Best,

    Jon

  • alexott McAfee Employee 125 posts since
    Jan 19, 2011

    Hi

     

    As Jon mentioned - such rule could be pretty "dangerous", and should be used with care. The main reason - there are many file types in internet, and although the MWG has pretty big media type catalog - it still can lack some type definitions, so you can block many downloads, especially if such rule will be used in "Embedded Cycle", so many files inside installers, archives, etc. could be not detected & blocked.

     

    Regarding your particular cases:

    • the PHP file is very strange - it contains about 30Kb of null characters at the begin of file, and HTML content is after that null characters.
    • the www.hamariweb.com - the page contains embedded object (OLE object specified as Data URI), and we decode it, and this is binary object without particular signature.
  • nathan.tlou Newcomer 2 posts since
    Jun 7, 2010

    What I found that has been tested and has managed to work for me is using the property "MediaType.FromHeader" and set the Action of your choice base an entering a wildcarded format of the content type that you are trying to allow.

     

    In the case of the issue I was trying to overcome I had to create a rule using the property "MediaType.FromHeader" and asked it to match "Video/*" and set the rule action to "Block". The reason I have had to create this rule is because the customer I am working for is trying to block streaming media and Web Gateway V7.3.2 does not have "video/f4f" in its media catalogue.

     

    I hope that this is of some help to you

     

    Kindest Regards,

     

    Nathan Tlou

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points