UGC Managed Device Templates

A template is a basic component that allows you to configure all settings of a device, such as network settings, firewall rules, content filtering rules, etc. To create a template, go to the Endpoints ➜ Templates section, click Add, and provide a name and optional description for the template.

After creating a template, you can configure its settings. To do this, go to the desktop Endpoints --- configuration and select the required template in the drop-down menu.

Template settings are displayed in a tree view. When configuring templates, follow these rules:

  1. If the value of a setting is not defined in the template, nothing will be sent to the UGC managed device. In this case, the default setting will be used.

  2. Libraries (e.g., IP addresses, URL lists, MIME content type lists, applications, etc.) have no predefined content in UGMC. To use libraries in filtering policies, you need first to add items to them.

  3. It is recommended to create separate templates for different settings groups to avoid conflicts between settings when templates are combined into template groups and to make it easier to understand the final settings that will be applied to UGC managed device. For example, you can create separate templates for firewall rules, content filtering rules, libraries, etc.

When creating a template, the administrator can use sections such as "General Settings", "VPN Settings", "Network Policies", and "Libraries".

General Settings

This section defines the general UGC managed device settings:

Name

Description

UserGate client installation settings

These are the settings that control the installation of UserGate client software:

  • Collect endpoint data: collect information on the device (IP address, time of last connection to UGMC, user, computer name, OS version, UGC software version, CPU load, RAM usage, running processes and services, etc.).

    Default value: Yes.

    If disabled, UGMC will only obtain the following information on the device: IP address, endpoint device name, UGC software and Windows OS versions, current time, device boot time, CPU load, and RAM usage.

    Important! Disabling endpoint data collection affects how HIP profiles work.

  • Allow network access when UserGate Client stopped: configure access to the network when the UserGate Client software is stopped.

    Default value: Yes.

  • Allow user to disable firewall: allow the user to disable content filtering on the device using the GUI. The options are:

    • No: users are not allowed to disable content filtering.

    • Yes: users are allowed to disable content filtering.

    • By code: users are allowed to disable content filtering on entering a code. To allow a user to disable content filtering, you need to provide or generate a code that the client must enter on the device. You can also specify an expiration time for the code.

    In addition, when you allow the user to disable content filtering, you can specify how many times or for how long the filtering will be disabled.

    Default value: Yes (filtering can be disabled for 10 minutes without entering a code).

    Important! If you use a counter for the number of times filtering can be disabled (Allowed number of shutdowns), note that the counter is reset each time you change any settings in the Allow user to disable firewall section.

  • Allow user to uninstall UserGate Client: allow the user to uninstall the UserGate Client software. With the By code option, you need to provide or generate a code that the user must enter to be able to delete the software.

    Default value: Yes.

Important! These settings will not be applied if sync mode is not enabled (the Sync flag). If the flag is not set, the default value will be used.

Notifications

Configure alerts:

  • Show tray icon: UserGate Client will display an icon in the taskbar notification area.

  • Show notification tooltips: enable or disable sending notifications to the device.

    If notifications are disabled, the alerts will not display on the endpoint regardless of the settings for specific alert types (device added to/removed from quarantine, resource blocked).

  • Device added to quarantine message: send an alert when a device is blocked. To configure the alert, specify the message text and alert type. The alert will be displayed in a pop-up window.

  • Device removed from quarantine message: send an alert when a device is unblocked. To configure the alert, specify the message text and alert type. The alert will be displayed in a pop-up window.

  • Resource blocked message: send an alert when an attempt to visit the URL of a resource was blocked. To configure the alert, specify the message text and alert type. The alert will be displayed in a pop-up window.

Important! These settings will not be applied if sync mode is not enabled (the Sync flag). If the flag is not set, the default value will be used.

LogAn device settings

Specify the LogAn server to which the device will send event information. The LogAn server must be already registered in UGMC.

Important! These settings will not be applied if sync mode is not enabled (the Sync flag). If the flag is not set, the default value will be used.

VPN settings

This section allows you to configure VPN security profiles that define settings such as the pre-shared key and encryption and authentication algorithms. Multi-factor user authentication, where a one-time TOTP code can be used as the second factor, is also supported. The VPN settings are sent to the UserGate Client MD. The user can select the required VPN server for connecting in the initial GUI window.

Note VPN connections can only be configured for devices that run Windows OS 10 and higher. After the connection is terminated, new connection attempts will be made over the next 40 seconds. If connection is not restored during this time, the user will be shown a VPN server selection window.

To configure a VPN connection, provide these settings:

Name

Description

Enabled

Enable/disable a rule.

Name

The name of the security profile for connecting to the VPN server.

Description

Profile description.

VPN address

Host name (FQDN) or the IP address of the VPN server.

Important! Please note that if you specify the VPN server address as FQDN, there is no IP address enumeration. If the DNS server returns several addresses, an attempt to connect to the first address in the list will be made.

Протокол

VPN protocols to create a tunnel:

  • IPSec L2TP. Layer 2 Tunneling Protocol (L2TP) is used for creating tunnels and the IPSec protocol for protecting the data during transmission.

  • IKEv2 with a certificate. The IKEv2 protocol is used to create a secure channel, and certificates are used for mutual authentication of the server and the client.

    Important! When generating a client certificate, you need to specify the CN field, i.e. the ID of the certificate user.

  • IKEv2 with a name and a password. IKEv2 protocol is used to create a secure channel, and login and password (EAP-MSCHAP v2) are used to verify the client. This method is available only for users of the domain RADIUS server.

IKE mode

IKE mode (specify when selecting the IPSecL2TP protocol): Main or Aggressive.

The difference between the modes is that the aggressive mode uses fewer packets, which allows for quicker establishment of connections. The aggressive mode does not transmit some negotiation parameters and thus requires that they be configured identically at the opposite ends of the connection.

Основной режим. In the main mode, the devices exchange six messages. During the first exchange (messages 1 and 2), the encryption and authentication algorithms are negotiated. The second exchange (messages 3 and 4) implements the Diffie-Hellman (DH) key exchange. After the second exchange, the IKE service on each device creates a master key to use for authentication. The third exchange (messages 5 and 6) authenticates the reporter and responder of the connection (identity checking) and the information is secured using the encryption algorithm established earlier.

Агрессивный режим. In the aggressive mode, there are 2 exchanges, 3 messages in total. In the first message, the reporter transmits information corresponding to messages 1 and 3 of the main mode --- that is, the information on encryption and authentication algorithms as well as the DH key. The second message, transmitted by the responder, contains information corresponding to messages 2 and 4 of the main mode and also authenticates the responder. The third message authenticates the reporter and confirms the exchange.

Pre-shared key

This is a string that must match on the client and server for a successful connection. For IPSec L2TP protocol.

Phase 1

In the first phase, IKE security is negotiated. The authentication is done using a pre-shared key in the mode selected earlier. Provide the following settings:

  • Key lifetime: the time period after which the parties re-authenticate and re-negotiate the first-phase settings.

  • Dead peer detection interval: the state and availability of the neighboring devices is checked using the Dead Peer Detection (DPD) mechanism. DPD sends R-U-THERE messages periodically to check if the IPsec neighbor is available. Минимальный интервал проверки: 10 секунд; значение 0 отключает проверку.

  • Max failures: the maximum number of failed discovery requests to an IPsec neighbor after which the neighbor will be considered unavailable.

  • Diffie-Hellman groups: select the Diffie-Hellman group that will be used for key exchange. Instead of the key itself, certain general information is transmitted that the DH key generation algorithm needs to create the shared secret key. The larger the Diffie-Hellman group number, the more bits are used to make the key secure.

  • Security: the algorithms are used in their listing order. To reorder the algorithms, drag and drop them with the mouse or use the Up/Down buttons.

Phase 2

In the second phase, the method for securing IPsec connections is selected. You need to specify the following:

  • Время жизни ключа. the time period after which the nodes must rotate the encryption key. The lifetime for the second phase is shorter than for the first one, which entails a more frequent key rotation.

  • Максимальный размер данных, шифруемых одним ключом. the key lifetime can also be expressed in bytes. Если заданы оба значения (Время жизни ключа и Максимальный размер данных, шифруемых одним ключом), то счётчик, первый достигнувший лимита, запустит пересоздание ключей сессии.

  • Security: the algorithms are used in their listing order. To reorder the algorithms, drag and drop them with the mouse or use the Up/Down buttons.

If multi-factor authentication via one-time TOTP codes is used, the token is entered in a separate window that appears on the endpoint device after a certificate is selected or a login/password is entered.

Note The use of multi-factor authentication via one-time TOTP codes is only available for IKEv2 connections.
Note For users of a domain RADIUS server, if the first initialization of a TOTP device is performed via URL, you must additionally enable plain-text authentication (PAP) on the Network Policy Server.

Network Policies

This section contains settings for filtering policies, such as the firewall and content filtering policy.

Using firewall rules, the administrator can allow or deny any type of network traffic flowing to or from the UGC device. Source/destination IP addresses, users and user groups, services, applications, URL lists and categories, content types, HIP profiles, and rule schedules can all be used as conditions for the rules.

Templates can contain pre-rules and post-rules. Pre-rules always reside higher in the rule list and therefore have higher priority than post-rules. Post-rules always reside lower than pre-rules and therefore have lower priority. The ability to create pre- and post-rules allows the realm administrator to define flexible security policy settings.

ПримечаниеПравила применяются поочередно сверху вниз в том порядке, в котором они указаны в списке. Only the first rule in which all conditions are matched is applied. This means that more specific rules must be placed higher in the list than more general ones. To change the order in which the rules will be applied, use the Up/Down and Top/Bottom buttons or drag and drop the rules with the mouse.
ПримечаниеЧекбокс Инвертировать меняет действие условия на противоположное, что соответствует логическому «НЕ» (отрицание).
Note If there are no rules created, any traffic flowing from or to the UGC managed device is allowed.

To create a firewall rule, go to the Network policies ➜ Firewall section, click Add, select the rule's position (pre or post), and provide the desired settings.

Name

Description

Enabled

Enables or disables the rule.

Name

The name of the rule.

Description

A description of the rule.

Apply in

Specifies the scope of application of this rule on UGC managed devices. The options are as follows:

  • Inside perimeter: the rule will be applied if the computer with the UGC software installed is located inside the domain network.

  • Outside perimeter: the rule will be applied if the computer with the UGC software installed is located outside the domain network.

  • Anywhere: the rule will be applied regardless of the user computer's location.

Action

The action that the rule will take:

  • Deny: blocks the traffic.

  • Allow: allows the traffic.

  • Redirect to proxy: if the traffic matches the rule's conditions, redirect it to the specified proxy. When this action is selected, the URL lists, Categories, and Content types settings are not available.

Logging

Sets whether triggers for this rule should be logged on the LogAn server.

Proxy

If Redirect to proxy is selected as the action, the proxy is specified here by selecting a proxy profile. For more details on proxy profiles, see the Proxy Profiles chapter.

Users

Specify the LDAP users or user groups to which this firewall rule will be applied. To specify the users, a correctly configured LDAP connector is required. For more details, see the Users Catalogs section.

Source

The lists of source IP addresses for the traffic.

Important! Creating rules that simultaneously contain conditions for filtering traffic by source address and URL/URL category/content type is not recommended. Such rules may not work correctly.

The list can be created in advance in the Libraries ➜ IP addresses section or during the configuration of the rule. For more details on IP address lists, see the IP Addresses chapter.

Destination

The lists of destination IP addresses for the traffic.

The list can be created in advance in the Libraries ➜ IP addresses section or during the configuration of the rule. For more details on IP address lists, see the IP Addresses chapter.

Service

The service type, such as HTTP, HTTPS, or a service group.

The service or service group can be created in advance in the Libraries ➜ Services or Libraries ➜ Services groups section, respectively, as well as during the configuration of firewall rules. For more details on services, see the Services chapter.

Applications

List of applications to which this rule applies.

The application can be created in advance in the Libraries ➜ Applications section or during the configuration of the firewall rule. For more details on applications, see the Applications chapter.

URL Lists

The URL address lists.

The URL lists can be created in the Libraries ➜ URL lists or in the properties of firewall rules. For more details on working with URL lists, see the URL Lists chapter.

Important! When URL lists are used as conditions for traffic filtering, the services must be specified.

URL categories

UserGate URL Filtering 4.0 category lists. The administrator can control access to categories such as pornography, malicious websites, online casinos, gaming and entertainment websites, social networks, and many others.

You can also add URL category groups that can be created in the Libraries ➜ URL categories section or during rule configuration. For more details on categories, see the URL Categories chapter.

Important! When URL categories are used as conditions for firewall rules, the services must be specified.

Content types

The content type lists. Video, audio, images, executables, and other types of content can be controlled. Administrators can also create custom content type groups.

They can be created in the Libraries ➜ Content types section or in the properties of the firewall rule. For more details on working with MIME types, see the Content Types chapter.

Important! When content types are used as conditions for firewall rules, the services must be specified.

Time

The time when this rule will be active. The administrator can add the required time period in the Time Sets section or during the configuration of the rule.

Important! The schedule uses the timezone of the device with the UserGate Client software installed.

HIP profiles

The list of HIP profiles. The firewall rule will be applied only if the device matches the HIP objects specified in the profile. For more details on HIP profiles and objects, see the sections HIP Profiles and HIP Objects, respectively.

Important! To filter traffic based on the results of a compliance checking, a license for the Network access control at the host level module is required.

Endpoint devices

The specific devices to which this rule will apply. If nothing is specified here, the rule will apply to all devices to which this template is applied.

Libraries of items

This section contains website addresses, IP addresses, applications, and other items used in the configuration of UGC managed device rules.

Services

The Services section contains a list of common services based on the TCP/IP protocol, such as HTTP, HTTPS, FTP, and others. These services can be used in UGC managed device rules. A predefined list of services is supplied with the product. The administrator can add the desired items during use. To add a new service, follow these steps:

Name

Description

Шаг 1. Создать сервис.

Нажать на кнопку Добавить, дать сервису название, ввести комментарий.

Шаг 2. Указать протокол и порт.

Нажать на кнопку Добавить, выбрать из списка необходимый протокол, указать порты назначения и, опционально, порты источника. To specify a port range, you can use a dash (-), such as 33333-33355.

IP Addresses

The IP addresses section contains the list of IP address ranges that can be used in UGC managed device rules.

The administrator can add the desired items during use. To add a new address list, follow these steps:

Name

Description

Step 1. Create a list.

In the Groups pane, click Add and give a name to the IP address list.

Step 2. (Optional) Specify the list update address.

Specify the address of the server where the updatable list is stored. For more details on updatable lists, see later in this chapter.

Step 3. Add IP addresses.

In the Selected group addresses pane, click Add and enter the addresses.

An IP address entry can be in the form of an IP address or IP address/subnet mask (e.g., 192.168.1.5, 192.168.1.0/24).

The administrator can create custom IP address lists and manage them centrally. To create such a list, follow these steps:

Name

Description

Step 1. Create a file with the desired IP addresses.

Create a file named list.txt with the IP address list.

Step 2. Create an archive containing this file.

Поместить файл в архив zip с именем list.zip.

Step 3. Create a version file for the list.

Create a file named version.txt and specify the list version number inside it, such as 3. On each update of the list, the version number must be incremented.

Step 4. Upload the files to a web server.

Upload the list.zip and version.txt files to your website so that they can be downloaded.

Step 5. Create an IP address list and specify an update URL for it.

On each UserGate server, create an IP address list. When creating the list, select Updatable as the list type and enter the address for downloading updates. UserGate will check for a new version on your website according to the set update download schedule. The schedule can be configured in the list properties. The available options are:

  • Disabled: update checking will not be performed for the selected item

  • Daily

  • Weekly

  • Monthly

  • Every ... hours

  • Every ... minutes

  • Advanced.

With the Advanced option, a crontab-like format is used where the date/time string consists of six space-separated fields. The fields specify the time as follows: (minutes: 0-59) (hours: 0-23) (days of the month: 1-31) (month: 1-12) (days of the week: 0-6, where 0 is Sunday). Each of the first five fields can be defined using:

  • An asterisk (*) denotes the entire range (from the first number to the last).

  • A dash (-) denotes a number range. For example, "5-7" means 5, 6, and 7.

  • Lists: comma-separated numbers or ranges. For example, "1,5,10,11" or "1-11,19-23".

An asterisk or range spacing: used for spacing out values in ranges. The increment is given after a slash. Examples: "2-10/2" means "2,4,6,8,10" while "*/2" in the "hours" field means "every two hours".

Applications

Элемент библиотеки Приложения позволяет создать группы приложений для более удобного использования в правилах фильтрации сетевого трафика. For example, the administrator can create an application group called "Business applications" and place the desired applications there.

The UserGate Client software recognizes the application by its checksum, which enables the administrator to control network access for specific applications in a very precise and selective fashion --- for example, allow only a specific application version to access the network and block all other versions.

To add a new application group, follow these steps:

Name

Description

Шаг 1. Создать группу приложений.

In the Application groups pane, click Add and give a name to the new group.

Шаг 2. Добавить приложения.

Highlight the group just created, click Add in the Applications pane, and enter the name of the application and its checksum. The checksum for a Windows executable must be computed using the SHA1 algorithm --- e.g., using the fciv utility.

The user can export and import lists using the Export and Import buttons. Application list entries or application listing file entries must follow the APPLICATION_NAME HASH format.

Proxy Profiles

This section allows you to configure proxies to which the TCP traffic matching the rules will be redirected with the Redirect to proxy action.

Name

Description

Name

The proxy profile name.

Description

Profile description.

IP address

The IP address of the proxy server to which the traffic will be redirected.

Port

The port number of the proxy server to which the traffic will be redirected.

URL Lists

The URL lists page allows you to create URL lists to be used as black and white lists in content filtering rules.

To configure filtering using URL lists, follow these steps:

Name

Description

Шаг 1. Создать список URL.

In the URL lists pane, click Add and set:

  • List name

  • Description (optional)

  • List type: Local or Updatable

  • Case sensitivity:

    • Case-sensitive: a list of case-sensitive URLs

    • Case-insensitive: a list of case-insensitive URLs Using the list of this category avoids having to search through all spelling variants of the same expression that differ in letter case.

    • Domain: a list of domain addresses to use in DNS filtering rules.

  • Update URL if the list is updatable

Шаг 2. Добавить необходимые записи в новый список.

Add URL entries to the new list. You can use wildcards such as "^", "$", and "*":

  • "*": any number of any characters

  • "^": start of a line

  • "$": end of a line

The "?" and "#" characters cannot be used.

Step 3. Create an endpoint firewall rule containing one or more lists.

See the Network Policies section.

If you want to block an exact address, use the "^" and "$" characters:

^http://domain.com/exacturl$

To block an exact URL with all child directories, use the "^" character:

^http://domain.com/exacturl/

To block a domain with all possible URLs, use this notation:

domain.com

An example of interpreting URL entries:

Example entry

HTTP request processing

yahoo.com

or

*yahoo.com*

The entire domain along with all its URLs and 3rd level domains are blocked, e.g.:

http://sport.yahoo.com

http://mail.yahoo.com

https://mail.yahoo.com

http://sport.yahoo.com/123

^mail.yahoo.com$

Only this address is blocked: http://mail.yahoo.com

https://mail.yahoo.com

^mail.yahoo.com/$

Nothing is blocked, since the last forward slash character defines a URL, but there is no "https" or "http".

^http://finance.yahoo.com/personal-finance/$

Only this address is blocked:

http://finance.yahoo.com/personal-finance/

^yahoo.com/12345/

These are blocked:

http://yahoo.com/12345/whatever/

https://yahoo.com/12345/whatever/

The administrator can create custom lists and distribute them centrally. To create such a list, follow these steps:

Name

Description

Шаг 1. Создать файл с необходимым списком URL.

Создать текстовый файл list.txt со списком URL в следующем формате:

www.site1.com/url1

www.site2.com/url2

...

www.siteend.com/urlN

Step 2. Create an archive containing this file.

Поместить файл в архив zip с именем list.zip.

Step 3. Create a version file for the list.

Create a file named version.txt and specify the list version number inside it, such as 3. On each update of the list, the version number must be incremented.

Step 4. Upload the files to a web server.

Upload the list.zip and version.txt files to your website so that they can be downloaded.

Шаг 5. Создать список типа контента и указать URL для обновления.

On each UserGate server, create a URL list. When creating the list, select Updatable as the list type and enter the address for downloading updates. UserGate will check for a new version on your website according to the set update download schedule. The schedule can be configured in the list properties. The available options are:

  • Disabled: update checking will not be performed for the selected item

  • Daily

  • Weekly

  • Monthly

  • Every ... hours

  • Every ... minutes

  • Advanced.

With the Advanced option, a crontab-like format is used where the date/time string consists of six space-separated fields. The fields specify the time as follows: (minutes: 0-59) (hours: 0-23) (days of the month: 1-31) (month: 1-12) (days of the week: 0-6, where 0 is Sunday). Each of the first five fields can be defined using:

  • An asterisk (*) denotes the entire range (from the first number to the last).

  • A dash (-) denotes a number range. For example, "5-7" means 5, 6, and 7.

  • Lists: comma-separated numbers or ranges. For example, "1,5,10,11" or "1-11,19-23".

An asterisk or range spacing: used for spacing out values in ranges. The increment is given after a slash. Examples: "2-10/2" means "2,4,6,8,10" while "*/2" in the "hours" field means "every two hours".

URL Categories

Элемент библиотеки Категории URL позволяет создать группы категорий UserGate URL filtering для более удобного использования в правилах фильтрации контента. For example, the administrator can create a category group called "Business categories" and place the desired categories there.

To add a new category group, follow these steps:

Name

Description

Шаг 1. Создать группу категорий.

In the URL category groups pane, click Add and give a name to the new group.

Шаг 2. Добавить категории.

Highlight the group just created, click Add in the Categories pane, and select the desired categories from the list.

Content types

Using content type filtering, you can control the video and audio content, images, executables, and other content types.

To configure filtering by content type, follow these steps:

Name

Description

Шаг 1. Создать список типов контента.

In the Categories pane, click Add and give a name to the new content type list. Optionally, provide a description and update URL for the list.

Step 2. Add the relevant MIME types to the new list.

Add the relevant content type to the list in the MIME format. You can find descriptions of various MIME types on the Internet --- for example, see this link: https://www.iana.org/assignments/media-types/media-types.xhtml.

For example, to block *.doc documents, add the "application/msword" MIME type.

Шаг 3. Создать правило фильтрации контента, содержащее один или несколько списков.

See the Network Policies section.

The administrator can create custom content type lists and distribute them centrally. To create such a list, follow these steps:

Name

Description

Шаг 1. Создать файл с необходимыми типами контента.

Создать файл list.txt со списком типов контента.

Step 2. Create an archive containing this file.

Поместить файл в архив zip с именем list.zip.

Step 3. Create a version file for the list.

Create a file named version.txt and specify the list version number inside it, such as 3. On each update of the list, the version number must be incremented.

Step 4. Upload the files to a web server.

Upload the list.zip and version.txt files to your website so that they can be downloaded.

Шаг 5. Создать список типа контента и указать URL для обновления.

On each UserGate server, create a content type list. When creating the list, select Updatable as the list type and enter the address for downloading updates. UserGate will check for a new version on your website according to the set update download schedule. The schedule can be configured in the list properties. The available options are:

  • Disabled: update checking will not be performed for the selected item

  • Daily

  • Weekly

  • Monthly

  • Every ... hours

  • Every ... minutes

  • Advanced.

With the Advanced option, a crontab-like format is used where the date/time string consists of six space-separated fields. The fields specify the time as follows: (minutes: 0-59) (hours: 0-23) (days of the month: 1-31) (month: 1-12) (days of the week: 0-6, where 0 is Sunday). Each of the first five fields can be defined using:

  • An asterisk (*) denotes the entire range (from the first number to the last).

  • A dash (-) denotes a number range. For example, "5-7" means 5, 6, and 7.

  • Lists: comma-separated numbers or ranges. For example, "1,5,10,11" or "1-11,19-23".

An asterisk or range spacing: used for spacing out values in ranges. The increment is given after a slash. Examples: "2-10/2" means "2,4,6,8,10" while "/2" in the "hours" field means "every two hours".

Time Sets

The Time sets section allows you to define time intervals that can later be used in rules. The administrator can add the desired items during use. To add a new time set, follow these steps:

Name

Description

Шаг 1. Создать календарь.

В панели Группы нажать на кнопку Добавить, указать название календаря и его описание.

Шаг 2. Добавить временные интервалы в календарь.

В панели Элементы нажать на кнопку Добавить и добавить интервал. Give a name to the new interval and specify the time.