Why is the "unavailable" category not matching a negated category list?

<< Back to Knowledge Search



Why is the "unavailable" category not matching a negated category list?
Policy trace shows negated category as "n/a" instead of "MATCH" when URL category is "unavailable"


The "unavailable" category, is a "System Category", which means that the ProxySG wants to categorize the URL, but an error occurred trying to categorize the URL.  There are a number of conditions that would cause "unavailable" to be returned.  Please refer to KB article 000014680 for further details.

Negated category matches may not work as expected when ‘unavailable’ is returned.

If the ProxySG categorizes foo.com and gets ( Porn, unavailable ), then
   Category=Porn          -> is true
   Category=!Games    -> is “n/a”

Why?  One way to think of this is that ‘unavailable’ means that categorization is broken, and the list the policy engine got is non-exhaustive.  The content filter database might have returned “Games”, but instead SGOS does not know, and thus does not make decisions based on incomplete data.

Thus Blue Coat always recommends explicit handling of "unavailable".  You can decide if you want to fail open or fail close for that specific case.  Therefore, create policy that explicitly calls for the "unavailable" category and either ALLOW or DENY access.

Additional Information
Bug Number
InQuira Doc IdKB3270

Article Feedback

Hide Properties
First Published      10/01/2014
Last Modified      10/01/2014
Last Published      10/01/2014
Article Audience
Product      ProxySG
Topic      Content Filtering, Policy Management
Article Number      000016627
Was this helpful?
Previous MonthNext Month