ASA URL Filtering Configuration Example

ASA URL Filtering Configuration Example

To filter traffic has these advantages:

· It can help reduce security risks and prevent inappropriate usage.

· It can provide greater control over the traffic that passes through the security appliance.

Note: Because URL filtering is CPU−intensive, the use of an external filtering server ensures that the throughput of other traffic is not affected. However, based on the speed of your network and the capacity of your URL filtering server, the time required for the initial connection can be noticeably slower when traffic is filtered with an external filtering server.

You can filter connection requests that originate from a more secure network to a less secure network. Although you can use access control lists (ACLs) in order to prevent outbound access to specific content servers, it is difficult to manage usage this way because of the size and dynamic nature of the Internet. You can simplify configuration and improve security appliance performance with the use of a separate server that runs one of these Internet filtering products:

·         Websense Enterprise_filters HTTP, HTTPS, and FTP. It is supported by PIX firewall version 5.3 and later.

·         Secure Computing SmartFilter, formerly known as N2H2_filters HTTP, HTTPS, FTP, and long URL filtering. It is supported by PIX firewall version 6.2 and later.

In this example, the URL filtering server is located in a DMZ network. End users located inside the network try to access the web server located outside the network over the Internet.

These steps are completed during the user request for the web server:

1. The end user browses to a page on the web server, and the browser sends an HTTP request.

After the security appliance receives this request, it forwards the request to the web server and

simultaneously extracts the URL and sends a look−up request to the URL filtering server.

2. After the URL filtering server receives the look−up request, it checks its database in order to

determine whether to permit or deny the URL. It returns a permit or deny status with a look−up

response to the Cisco IOS® firewall.

3.The security appliance receives this look−up response and performs one of these functions:

¨ If the look−up response permits the URL, it sends the HTTP response to the end user.

If the look−up response denies the URL, the URL filtering server redirects the user to its own

internal web server, which displays a message that describes the category under which the

URL is blocked. Thereafter, the connection is reset on both ends.

¨

4.Identify the Filtering Server

·         You need to identify the address of the filtering server with the url−servercommand. You must use the appropriate form of this command based on the type of filtering server you use.

Note: For software version 7.x and later, you can identify up to four filtering servers for each context. The security appliance uses the servers in order until a server responds. You can only configure a single type of server, either Websense or N2H2, in your configuration.

Websense

Websense is a third−party filtering software that can filter HTTP requests on the basis of these policies:

·         destination hostname

·         destination IP address

·         keywords

·          user name

Software version 7.x and later:

pix(config)# url−server (if_name) host local_ip [timeout seconds] [protocol TCP | UDP [connections num_conns] ]

Replace if_name with the name of the security appliance interface that is connected to the filtering server. The default is inside. Replace local_ip with the IP address of the filtering server. Replace seconds with the number of seconds the security appliance must continue to try to connect to the filtering server.

Use the protocol option in order to specify whether you want to use TCP or UDP. With a Websense server, you can also specify the version of TCP you want to use. TCP version 1 is the default. TCP version 4 allows the PIX firewall to send authenticated user names and URL logging information to the Websense server if the PIX firewall has already authenticated the user.

For example, in order to identify a single Websense filtering server, issue this command:

hostname(config)#url−server (DMZ) vendor websense host 192.168.15.15 protocol TCP version 4

Secure Computing SmartFilter

Software version 7.2 and later:

hostname(config)#url−server (if_name) vendor {secure−computing | n2h2} host <local_ip>

[port <number>] [timeout <seconds>] [protocol {TCP [connections <number>]} | UDP]

For the vendor {secure−computing | n2h2}, you can use secure−computing as a

vendor string. However, n2h2 is acceptable for backward compatibility. When the configuration

entries are generated, secure−computing is saved as the vendor string.

·  Replace if_name with the name of the security appliance interface that is connected to the filtering server. The default is inside. Replace local_ip with the IP address of the filtering server and port <number> with the desired port number.

Note: The default port used by the Secure Computing SmartFilter server to communicate with the security appliance with TCP or UDP is port 4005.

Replace seconds with the number of seconds the security appliance must continue to try to connect to the filtering server. Use the protocol option in order to specify whether you want to use TCP or UDP.

The connections <number> is the number of times to attempt to make a connection between the host and server.

For example, in order to identify a single N2H2 filtering server, issue this command:

hostname(config)#url−server (DMZ) vendor n2h2 host 192.168.15.15 port 4444 timeout 45 protocol tcp connections 10

Or, if you want to use default values, issue this command:

hostname(config)#url−server (DMZ) vendor n2h2 host 192.168.15.15

Configuration :-

ciscoasa#show running−config

: Saved

:

ASA Version 8.0(2)

!

hostname ciscoasa

domain−name Security.lab.com

enable password 2kxsYuz/BehvglCF encrypted

no names

dns−guard

!

interface GigabitEthernet0/0

speed 100

duplex full

nameif outside

security−level 0

ip address 172.30.21.222 255.255.255.0

!

interface GigabitEthernet0/1

description INSIDE

nameif inside

security−level 100

ip address 192.168.5.11 255.255.255.0

!

interface GigabitEthernet0/2

description LAN/STATE Failover Interface

shutdown

!

interface GigabitEthernet0/3

description DMZ

nameif DMZ

security−level 50

ip address 192.168.15.1 255.255.255.0

!

interface Management0/0

no nameif

no security−level

no ip address

!

passwd 2KFQnbNIdI.2KYOU encrypted

boot system disk0:/asa802−k8.bin

ftp mode passive

clock timezone CST −6

clock summer−time CDT recurring

dns server−group DefaultDNS

domain−name Security.lab.com

same−security−traffic permit intra−interface

pager lines 20

logging enable

logging buffer−size 40000

logging asdm−buffer−size 200

logging monitor debugging

logging buffered informational

logging trap warnings

logging asdm informational

logging mail debugging

logging from−address aaa@cisco.com

mtu outside 1500

mtu inside 1500

mtu DMZ 1500

no failover

failover lan unit primary

failover lan interface interface GigabitEthernet0/2

failover link interface GigabitEthernet0/2

no monitor−interface outside

icmp unreachable rate−limit 1 burst−size 1

asdm image disk0:/asdm−602.bin

asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 172.30.21.244 1

timeout xlate 3:00:00

timeout conn 1:00:00 half−closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp−pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip−invite 0:03:00 sip−disconnect 0:02:00

timeout uauth 0:05:00 absolute

ldap attribute−map tomtom

dynamic−access−policy−record DfltAccessPolicy

url−server (DMZ) vendor websense host 192.168.15.15 timeout 30 protocol TCP version 1 connections url−cache dst 100

aaa authentication ssh console LOCAL

aaa authentication enable console LOCAL

aaa authentication telnet console LOCAL

filter url except 192.168.5.5 255.255.255.255 172.30.21.99 255.255.255.255

filter url http 192.168.5.0 255.255.255.0 172.30.21.99 255.255.255.255 allow

proxy−block longurl−truncate cgi−truncate

http server enable

http 172.30.0.0 255.255.0.0 outside

no snmp−server location

no snmp−server contact

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 60

console timeout 0

management−access inside

dhcpd address 192.168.5.12−192.168.5.20 inside

dhcpd enable inside

!

threat−detection basic−threat

threat−detection statistics access−list

!

class−map inspection_default

match default−inspection−traffic

!

!

policy−map global_policy

class inspection_default

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect icmp

!

service−policy global_policy global

url−block url−mempool 2

url−block url−size 2

url−block block 10

username fwadmin password aDRVKThrSs46pTjG encrypted privilege 15

prompt hostname context

Cryptochecksum:db208a243faa71f9b3e92491a6ed2105

: end