McAfee Web Gateway
Advanced, proactive security for enabling safe, secure access to the web

Features & Benefits:

Get the industry’s best protection
Use proactive intent analysis to filter out malicious content from web traffic in real time. By scanning a web page’s active content, emulating and understanding its behavior, and predicting its intent, McAfee Web Gateway proactively protects against zero-day and targeted attacks. Outbound malware detection identifies and isolates existing infections phoning home, and prevents sensitive data from leaving the organization through Web 2.0 sites.

Use layered security to enhance protection
Web Gateway combines local protection from McAfee Gateway Anti-Malware Engine, its powerful, proactive intent analysis, with cloud-based McAfee Global Threat Intelligence (GTI) to provide advanced protection. For both URL categorization and security-focused web reputation, choose between on-premise and cloud lookups, or opt to use a combination of both for optimal protection and performance. Additional protection through McAfee file reputation cloud-based virus lookup capabilities enable Web Gateway to provide greater protection while optimizing security on a single platform.

Extend management with a powerful policy engine and granular application control
A powerful policy engine enables unmatched flexibility and control in creating and applying policy, supporting the multi-tenancy needs of the largest enterprises and service providers. Web Gateway also extends this flexible control to web applications. Beyond simply allowing or denying access, Web Gateway provides granular function control within nearly 1,000 web applications, including popular social and streaming media, file sharing, and anonymizing applications.

Block data loss
Keep confidential information from leaking out of your organization by scanning user-generated content on all key web protocols. Have advanced data loss needs? Rely on Web Gateway to integrate with McAfee Data Loss Prevention (DLP) solutions.

Protect encrypted traffic
Close the new backdoor through your security barrier with fully integrated malware detection, SSL inspection, and certificate validation directly on the Web Gateway appliance.

Leverage powerful reporting tools and customizable dashboards
Identify your organization’s usage trends, isolate problems, document inappropriate web activity, and comply with regulations with powerful reporting capabilities and integration with the McAfee ePolicy Orchestrator (ePO) platform. Use this information to tailor filtering settings to best enforce your web-usage policies.

Solutions:

As web application use and sophistication increase, so does the need for flexible access coupled with advanced web security because even seemingly “safe” sites can be targeted for malware distribution.

In today’s world, simply blocking known viruses from downloading or restricting access to “known bad” websites is not enough. Reactive techniques, such as signature-based antivirus and category only URL filtering, were never designed to enable Web 2.0 access or combat today’s exploits.

The simple blocking approach offered by these solutions means entire pages or even domains can be blocked rather than the specific malicious code or object, hindering productivity while generating helpdesk calls. And since these solutions focus on known content and malicious objects or executables, they can’t prevent today’s attacks that hide malicious code within seemingly good HTTP or HTTPS traffic or provide protection against unknown or emerging threats. The ability to enable secure, granular access to Web 2.0 applications while proactively blocking unknown, as well as known, threats is now crucial.

McAfee understands the security needs of the web-enabled world like no other vendor and offers the industry’s most effective, proven proactive solution: McAfee Web Gateway.

Complete Inbound and Outbound Protection

McAfee Web Gateway delivers comprehensive security for all aspects of web traffic, regardless of location or device. For user-initiated web requests, McAfee Web Gateway first enforces an organization’s Internet use policy. For all allowed traffic, it then uses local and global techniques to analyze the nature and intent of all content and active code entering the network via the requested web pages, providing immediate protection against malware and other hidden threats. And, unlike basic packet inspection techniques, McAfee Web Gateway can even examine SSL traffic to provide in-depth protection against malicious code that has been disguised through encryption.

Inbound protection also mitigates risks for organizations hosting websites that accept data or document uploads from external sources. McAfee Web Gateway in reverse proxy mode scans all content before it is uploaded, securing both the server and the content.

To secure outbound traffic, McAfee Web Gateway scans user-generated content on all key web protocols—including HTTP, HTTPS, and FTP—and protects against loss of confidential information and other threats leaking from the organization through social networking sites, blogs, wikis, and even online productivity tools such as organizers and calendars. McAfee Web Gateway also safeguards against unauthorized data leaving the organization through “bot-infected” machines attempting to phone home or transmit sensitive data.

McAfee Web Gateway Delivers the Industry’s Best Protection

As the number one-rated malware protection,* McAfee Web Gateway uses a patent-pending approach to signature-less intent analysis with the McAfee Gateway Anti-Malware Engine. Proactive intent analysis filters out malicious content from web traffic in real time. By scanning a web page’s active content, emulating and understanding its behavior, and predicting its intent, McAfee Web Gateway proactively protects against zero-day and targeted attacks as they occur.

McAfee Web Gateway now integrates with McAfee Advanced Threat Defense—advanced anti-malware detection technology, with innovative sandbox capabilities that combine static and dynamic analysis. The result is greater accuracy and stronger protection against advanced, dynamic malware threats.

McAfee combines this local, real-time intent analysis with comprehensive McAfee antivirus protection to quickly block known viruses and several cloud-based technologies—all powered by McAfee Labs. Use of multiple technologies enables McAfee Web Gateway to provide greater protection while optimizing security on a single platform with different, yet complementary, technologies—something many organizations want for their defense-in-depth security approaches.

• McAfee antivirus with real-time McAfee Global Threat Intelligence (McAfee GTI) file reputation—With cloud-based McAfee GTI file reputation look-up capabilities, McAfee closes the gap between virus discovery and system update/protection.
• McAfee GTI web reputation and web categorization—McAfee Web Gateway delivers enhanced web filtering functionality and protection through the powerful combination of both reputation and category-based filtering. McAfee GTI powers McAfee Web Gateway’s web filtering technologies. McAfee GTI creates a profile of all Internet entities—websites, email, and IP addresses—based on hundreds of different attributes gathered from the massive, global data collection capabilities of McAfee Labs. It then assigns a reputation score based on the security risk posed, enabling administrators to apply very granular rules about what to permit or deny.

different attributes gathered from the massive, global data collection capabilities of McAfee Labs. It then assigns a reputation score based on the security risk posed, enabling administrators to apply very granular rules about what to permit or deny.

Protection for encrypted traffic

Sophisticated cybercriminals have turned to SSL traffic (HTTPS) as the new back door through the enterprise’s security barrier. Ironically, a protocol designed to provide security must now also be secured against abuse, just as traditional HTTP traffic must be secured. McAfee Web Gateway is the first security product that fully integrates malware detection, SSL inspection, and certificate validation. There’s no need to route encrypted traffic to a separate box for malware inspection. McAfee Web Gateway directly scans all SSL traffic to ensure the complete security, integrity, and privacy of encrypted transactions.

Data loss prevention

McAfee Web Gateway protects organizations from outbound threats—such as leakage of confidential information—by scanning outbound content over all key web protocols, including SSL. This makes it an essential tool for preventing intellectual property loss, ensuring and documenting regulatory compliance, and providing forensic data in the event of a breach. Now integrated with the McAfee Data Loss Prevention (DLP) solution, McAfee Web Gateway supports predefined DLP dictionaries and enables custom dictionaries to be created through keyword matching and/or regular expressions.

Mobile filtering for remote users

As the workforce becomes more distributed and mobile, the need for web filtering and protection to seamlessly transition from the office to the road becomes increasingly important. With McAfee Client Proxy, a tamperproof client agent enables roaming users to seamlessly authenticate and redirect to a McAfee Web Protection solution, either Security-as-a-Service (SaaS) or our onpremises web gateway. This enables Internet access policy enforcement and full security scanning to be applied to roaming users, even if their Internet access is being provided through a captive portal, such as at a coffee shop, hotel, or other Wi-Fi hotspot.

McAfee Web Gateway also allows enterprises to extend and enforce their security policies on mobile devices. Today’s popular smartphones and tablets, including BlackBerry, Apple iPhone, Apple iPad, and Google Android, can direct web traffic to McAfee Web Gateway which, through standard device management and security controls, ensures that mobile devices are secured with advanced anti-malware protection and corporate web filtering policies. McAfee Web Gateway also extends protection to mobile devices accessing content that is traditionally available on internal corporate servers such as intranets, wikis, Microsoft SharePoint servers, and other webbased solutions. While this information is generally not made available to certain mobile devices due to security concerns, McAfee Web Gateway setup as a reverse proxy can enable controlled and secure access to these internal resources.

McAfee Web Gateway Delivers Control

McAfee Web Gateway enables today’s web-centric enterprises with a powerful rules-based engine for optimal policy flexibility and control. To streamline policy creation, McAfee Web Gateway offers an extensive pre-built rules library with common policy actions. Organizations can pick and choose various rules, easily modify these rules, and share their own rules through an online community.

The McAfee Web Gateway platform extends policy flexibility and control to web applications as well, enabling granular, proxy-based control over how web applications are used. Organizations can choose from nearly 1,000 popular web applications, enabling or disabling specific functionality as needed, controlling who uses a web application and how it is used. Do you want to enable access to Facebook but not allow games? No problem. The combination of flexible policy creation, advanced anti-malware scanning, and web reputation also means that McAfee Web Gateway can remove malicious links (based on reputation or category) from a web page or extract only the malicious code while letting the balance of the page display—fully optimizing productivity and granular Web 2.0 security.

Web gateway flexibility and control also extends to user authentication and access. McAfee Web Gateway supports numerous authentication methods, including NTLM, RADIUS, AD/LDAP, eDirectory, cookie authentication, Kerberos, or a local user database. The McAfee Web Gateway authentication engine allows administrators to implement flexible rules, including the use of multiple authentication methods. For example, McAfee Web Gateway can try to transparently authenticate a user and, based on the result, prompt the user for credentials, use another authentication method, apply a restrictive policy, or simply deny access. Integration with McAfee Cloud Single Sign On adds the convenience and added security of secure single sign-on for more than 400 popular web applications with user account provisioning/de-provisioning and multifactor authentication.

McAfee Web Gateway extends access control to streaming content through native streaming proxy support as well, providing bandwidth savings, and reduced latency.

McAfee Web Gateway Delivers Agile Infrastructure and Performance

McAfee Web Gateway is a high-performance, enterprise-grade proxy that provides the caching, authentication, administration, and authorization controls required by today’s most demanding enterprises. Offering multiple appliance models—all with integrated high availability and support for virtualized machines, in-the-cloud service with McAfee SaaS Web Protection, and even a blade option, McAfee Web Gateway delivers the deployment flexibility and performance you need, along with the scalability to easily support hundreds of thousands of users in a single environment. (For more information on SaaS or large data center deployments, see McAfee SaaS Web Protection or McAfee Content Security Blade Server on McAfee.com.)

With McAfee Web Gateway flexibility, you can mix deployment options as well. For example, you can offload portions of web traffic to the cloud during peak times for added high-availability performance or use this hybrid model as a cost-effective fail-over option. Common policies and reporting for hybrid on-premises and cloud deployments help streamline management, ensure consistent policy enforcement, and simplify reporting, tracking, and investigation.

McAfee Web Gateway offers numerous implementation options—from explicit proxy to transparent bridge and router modes—to ensure that your network architecture is supported.

With support for numerous integration standards, McAfee Web Gateway is designed to work in your unique environment. From the web cache communication protocol (WCCP) to the Internet content adaptation protocol (ICAP/ICAPS), McAfee Web Gateway efficiently communicates with other network devices and security appliances.

Additionally, McAfee Web Gateway now offers IPv6 support, helping larger organizations and federal institutions comply with regulations. McAfee Web Gateway bridges the gap between internal IPv4 and external IPv6 networks and applies all available security and infrastructure features and functions to the traffic.

Value and a Platform for the Future

McAfee Web Gateway combines and integrates numerous protections that would otherwise require multiple stand-alone products. Web filtering, antimalware, antispyware, SSL scanning, data loss prevention, and content control filtering—you can get all of these protections in a single, costeffective appliance. And a simplified management footprint means that a single security policy can be shared across protections and protocols, saving you valuable time and money

Security Risk Management and Reporting

The most popular and respected security management technology, the McAfee ePolicy Orchestrator® (McAfee ePO™) platform, is supported by McAfee Web Gateway. As the single source for consolidated information, the McAfee ePO platform helps you quickly identify and mitigate problems and improve compliance management.

McAfee ePO software supports detailed web reporting through the McAfee Content Security Reporter extension. McAfee Content Security Reporter gives you the information and forensic tools you need to understand how your organization is using the web, comply with regulations, identify trends, isolate problems, document inappropriate web activity, and tailor your filtering settings to enforce your web usage policies. It combines dashboard views and drilldowns into web traffic with powerful offline processing—everything you need in one easy-to-use solution. McAfee Content Security Reporter offers an external, stand-alone report server designed to offload resource-intensive data processing and storage from the existing McAfee ePO server, enabling it to scale to meet the reporting needs of even the largest global corporations.

Licensing

For the ultimate in deployment flexibility and to help future-proof your investment, McAfee offers all features of the McAfee Web Gateway and McAfee SaaS Web Protection Service in a single suite: McAfee Web Protection. Deploy on premises, in the cloud, or both for added deployment flexibility and high availability—the choice is yours. You’ll find award-winning McAfee anti-malware protection and comprehensive web filtering with either option.

McAfee Web Gateway hardware is sold separately.

* In recent tests conducted by AV-TEST, McAfee Web Gateway detected 94.5% of zero-day malware, 99.8% of malicious Windows 32 portable executable (PE) files, and 98.63% of non-PE files. “McAfee Web Gateway Security Appliance Test,” AV-TEST GmbH.

System Requirements:

Deployment flexibility is a hallmark of McAfee Web Gateway. You can deploy it as a virtual machine, hardware appliance, or on a blade server.

Requirements for setting up a virtual appliance

• VMware ESX or VMware ESXi (VMware Workstation version 5.5 or later is not supported, but can be used for testing purposes.)
• Virtual machine host system with the following specifications:
  • CPU: 64-bit capable
  • Virtualization extension: VT-x/AMD-V
• Virtual machine with the following specifications:
  • Memory: 4 GB
  • Hard disk space: 200 GB
  • CPU cores: 2 (minimum)

Appliances

A complete range of enterprise- and medium-capacity appliances offers affordable protection and scalability for the most demanding business environments.

• Model WG4000
  • Form factor: 1U rack mount
  • RAM: 4 GB
  • Processor: Dual core
  • Processor cache: 1 MB
  • Disk: 500 GB SATA
  • RAID level: N/A
  • Power supply: 350 W
  • Interfaces: 3 x 10/100/1000 Ethernet
• Model WG4500
  • Form factor: 1U rack mount
  • RAM: 4 GB
  • Processor: Dual core
  • Processor cache: 4 MB
  • Disk: 2 x 300 GB SAS
  • RAID level: Raid-1
  • Power supply: 400 W
  • Interfaces: 3 x 10/100/1000 Ethernet
• Model WG5000
  • Form factor: 1U rack mount
  • RAM: 96 GB
  • Processor: 6 core
  • Processor cache: 15 MB
  • Disk: 2 x 600 GB SAS
  • RAID level: Raid-1
  • Power supply: 2 x 650 W (hot swap)
  • Interfaces: 4 x 10/100/1000 Ethernet; 1 x 1000BASE-SX optical network card
• Model WG5500
  • Form factor: 1U rack mount
  • RAM: 128 GB
  • Processor: 2 x 10 core
  • Processor cache: 25 MB
  • Disk: 6 x 300 GB SAS
  • RAID level: Raid-10
  • Power supply: 2 x 750 W (hot swap)
  • Interfaces: 4 x 10/100/1000 Ethernet; 1 x 1000BASE-SX optical network card

Specifications:

Model Name	WBG-4500-C	WBG-5000-C	WBG-5500-C
Hardware Specifications
Form Factor	Intel SR1630GPRX, 1U	Intel R1304SP4SHOC, 1U	Intel R1208GZ4GC, 1U
Supported Software Versions	7.3.2.4 and higher	7.3.2.4 and higher	7.3.2.4 and higher
Processor	Intel Core i3-540, 3.06 GHz, 4 MB cache, 2 core	1 x Intel Xeon E5-2430, 2.20 GHz, 15 MB cache, 6 core	2 x Intel Xeon E5-2680V2, 2.80 GHz, 25 MB cache, 10 core
Memory	4 GB, 1333 MHz, ECC	6 x DIMM, 96 GB, 1600 MHz, DDR3, 2RX4 ECC, REG, DUAL	8 x DIMM, 128 GB, 1600 MHz, DDR3, 2RX4 ECC, REG, DUAL
Network Interfaces	5 x 10/100/1000 MB RJ-45 Ethernet ports	4 x 10/100/1000 MB RJ-45 Ethernet ports	4 x 10/100/1000 MB RJ-45 Ethernet ports
Optical Network Card	N/A	Optical cards are supported as third-party add-ons and must be purchased separately. For compatible modules, reference the product documentation.	Optical cards are supported as third-party add-ons and must be purchased separately. For compatible modules, reference the product documentation.
USB Interfaces	3 USB 2.0 ports on rear	4 USB 2.0 ports on rear, 2 on front	USB 2.0 connectors. 3 on back panel
Serial Interfaces	RJ-45 Serial-A Port	RJ-45 Serial-A Port	RJ-45 Serial-A Port
RAID	RAID-1	RAID-1	RAID-10
Hard Disk	2x 300 GB SAS 3.5 in., 15K RPM, hot swap	2 x HDD, 2.5 in., 600 GB, SAS 6 Gbps, 10K.6 RPM	6 x HDD, 2.5 in., 300 GB, SAS 6 Gbps, 10K.6 RPM
Optical	8x DVD-ROM DRIVE	8x DVD ROM DRIVE, SLIMLINE	8x DVD ROM DRIVE, SLIMLINE
Voltage	Auto Switch 110/220 V	Auto Switch 110/220 V	Auto Switch 110/220 V
Max Amps	6 A (RMS) @ 90 VAC; 3 A (RMS) @ 180 VAC	6 A (RMS) @ 110 VAC; 3 A (RMS) @ 220 VAC	12 A (RMS) @ 90 VAC; 6 A (RMS) @ 180 VAC
Startup VAC	85 VAC +/– 4 VAC	85 VAC +/– 4 VAC	85 VAC +/– 4 VAC
Input Voltage Range	110 V (90 Vrms –140 Vrms) 220 V (180 Vrms –264 Vrms)	110 V (90 Vrms –140 Vrms) 220 V (180 Vrms –264 Vrms)	110 V (90 Vrms –140 Vrms) 220 V (180 Vrms –264 Vrms)
Power Rating	400 W	2 X 650 W	2 X 750 W
Power Consumption	400 W	710 W	710 W
Dimensions	Height: 1.67 in. or 42.42 mm Width: 16.93 in. or 430.02 mm Depth: 25.51 in. or 648 mm	Height: 1.70 in. or 43.2 mm Width: 19.01 in. or 483 mm Depth: 22.28 in. or 566 mm	Height: 1.70 in. or 43.2 mm Width: 19.01 in. or 483 mm Depth: 28.93 in. or 735 mm
Max Weight	33 lbs 15 KG	41 lbs 18.6 KG	50 lbs 22.7 KG
MTBF	47,000 hours	69,000 hours	57,000 hours
Remote Access Card	No	RMM4	RMM4
Power Supply Unit	350 W Non-Redundant	450 W Redundant PSU	750 W Redundant PSU
Motherboard	S3420GPRX	S1400SP4	S2600GZ
Environmental and Regulatory Specifications
Operating Temperature	10°C to 35°C (50ºF to 95ºF) with the maximum rate of change not to exceed 10°C per hour	10°C to 35°C (50ºF to 95ºF) with the maximum rate of change not to exceed 10°C per hour	10°C to 35°C (50ºF to 95ºF) with the maximum rate of change not to exceed 10°C per hour
Non- Operating Temperature	-40ºC to 70ºC (-40ºF to 158ºF)	-40ºC to 70ºC (-40ºF to 158ºF)	-40ºC to 70ºC (-40ºF to 158ºF)
Non- Operating Humidity	50% to 90%, non-condensing with a maximum wet bulb of 28°C (at temperatures from 25°C to 35°C)	50% to 90%, non-condensing with a maximum wet bulb of 28°C (at temperatures from 25°C to 35°C)	50% to 90%, non-condensing with a maximum wet bulb of 28°C (at temperatures from 25°C to 35°C)
Acoustic Noise	7.0 BA in an idle state at typical office ambient temperature. (23 ±2°C)	7.0 BA in an idle state at typical office ambient temperature. (23 ±2°C)	7.0 BA in an idle state at typical office ambient temperature. (23 ±2°C)
Shock, Operating	Half sine, 2 g, 11 ms	Half sine, 2 g, 11 ms	Half sine, 2 g, 11 ms
Shock, Unpackaged	Trapezoidal, 25 g, velocity change 136 inches/sec (≥40 lbs to < 80 lbs)	Trapezoidal, 25 g, 170 inches/sec	Trapezoidal, 25 g, velocity change is based on packaged weight
Shock, Packaged	Non-palletized free fall in height 24 in. (≥40 lbs to < 80 lbs)	Non-palletized free fall in height 18 in. (≥40 lbs to < 80 lbs)	Non-palletized free fall in height 18 in. (≥40 lbs to < 80 lbs)
Vibration, Unpackaged	5 Hz to 500 Hz, 2.20 g RMS random	5 Hz to 500 Hz, 3.13 g RMS random	5 Hz to 500 Hz, 2.20 g RMS random
ESD	Air discharge 12 KV, Contact Discharge 8.0 KV	Air discharge 12 KV, Contact Discharge 8.0 KV	Air discharge 12 KV, Contact Discharge 8.0 KV
System Cooling Requirement	1660 BTU/hour	2550 BTU/hour	2550 BTU/hour
Safety
EN 60950-1:2006/A11:2009/A1: 2010/A12:2011	Yes	Yes	Yes
UL60950-1/CSA C22.2 No. 60950-1, 2nd Edition + AMD 1:2011	Yes	Yes	Yes
EMC
Title 47 of the CFR, Part 15, Class A	Yes	Yes	Yes
ICES-003 Issue 4, February 7, 2004 Class A	Yes	Yes	Yes
EN 55022:2010 + AC:2011	Yes	Yes	Yes
EN 55024: 2010	Yes	Yes	Yes
VCCI V-1/07.09, V-2/08.04, V-3/08.04, V-4/07.04	Yes	Yes	Yes
BSMI CNS13438 Emissions (Taiwan)	Yes	Yes	Yes
AS/NZS CISPR 22 Emissions (Australia/NZ)	Yes	Yes	Yes
EN 61000-4-2 ESD	Yes	Yes	Yes
EN 61000-4-3 RF Immunity	Yes	Yes	Yes
EN 61000-4-6 Conducted Immunity	Yes	Yes	Yes
EN 61000-4-4 Electrical Fast Transients	Yes	Yes	Yes
Country Approvals
USA	Yes	Yes	Yes
Canada	Yes	Yes	Yes
European Union (CE Mark)	Yes	Yes	Yes
China CCC	Yes	Yes	Yes
EAC (Euro-Asia Conformity) Russia, Kazakhstan, and Belarus	Yes	Yes	Yes
Argentina IRAM	Yes	Yes	Yes
South Africa LoA/SABS	Yes	Yes	Yes
Korea MISP	Yes	Yes	Yes
Australia/New Zealand	Yes	Yes	Yes
Israel	Yes	Yes	Yes
Croatia	Yes	Yes	Yes
Japan	Yes	Yes	Yes

Documentation:

Download the McAfee Web Gateway Datasheet (PDF).

Download the McAfee Web Gateway Appliance Specifications Datasheet (PDF).