Technical Tip: How to enable access only to internal domains hosted on Google while web filter category 'Web-based Email' is set to block

[gmanea]

Description

This article describes how to enable access to internal domains hosted on Google while webfilter category 'Webmail' is set to block. 

Example.

'company.com' is hosted on Gmail and to restrict access only to these accounts any other web mail service (Google or not) should be disabled.  

Solution

- If these options are not visible, check if  proxy-based web filter profile is used since this feature is only supported in proxy-based

- Deep inspection is necessary to restrict Google account for specific domain.

1) Create from a web filter profile called 'block_noncorp_mail' using GUI.

2) Enable 'URL Filter' under static filter and create a dummy entry, like 'example.com'.

3) Enable 'Restrict Google account for specific domain' and define the domain that is hosted on Google mail services. 

4) Go to CLI and the following entries and verify if they look like the following:

# config web-proxy profile

    edit "Auto-web-proxy-profile_ff0ygfu3d"

        # config headers

            edit 1

                set name "X-GoogApps-Allowed-Domains"

                set content "company.com"       <----- The company domain hosted in Google mail services.

            next

        end

    next

end

show config webfilter urlfilter .

    edit 1

        set name "Auto-webfilter-urlfilter_gkkqnfrif"

        # config entries

            edit 1

                set url "example.com"

                set action block

            next

        end

    next

end

Change it with the following entries in the exact same order.

# config webfilter urlfilter

    edit 1

        set name "Auto-webfilter-urlfilter_gkkqnfrif"

        # config entries

            delete 1                                <----- This will delete the 'example.com' entry created from GUI.

            edit 1

                set url "*.google.com"

                set type wildcard

                set web-proxy-profile "Auto-web-proxy-profile_ff0ygfu3d"

            next

            edit 2

                set url "gmail.com"

            next

            edit 3

                set url "google.com"

            next

        end

    next

end

Outcome: 

- Access to any email service will be denied (according to the web mail Category)

- Access to personal Gmail Accounts on any other domain hosted on Gmail will be denied.

- Access only form addresses containing @company.com will be allowed.