CFS must be licensed and enabled before you can use it. For more information about global CFS settings, exclusions, and custom categories, see the SonicOS Security Services Administration documentation.
An outline of how CFS works is as follows:
A packet arrives and is examined by CFS.
CFS checks it against the CFS Exclusion addresses configured on the POLICY | Security Services > Content Filter page and allows it through if a match is found, meaning that the source address is excluded from content filtering.
CFS checks its policies to find the first policy that matches these conditions in the packet:
Included Source Address object/group, but not matching the Excluded Source Address object/group
Included User/Group, but not matching the Excluded User/Group
CFS uses the CFS Profile defined in the matching policy to do the filtering and returns the corresponding action for this packet.
If no policy is matched, the packet is passed through without any action by CFS.
CFS performs the action defined in the CFS Action Object for the matching policy.