Cisco Firewall :: URL Filtering On ASA 5510 With RegEx But Getting Unexpected Results
Feb 28, 2013
I'm trying to block access to dropbox.com on our ASA5510. I have it setup and it blocks dropbox.com just fine. But it is also blocking google.com. I can't figure out why.
Here's my config. When it blocks google, it blocks it with the terminated by inspection engine, reason - disconnected, dropped packet.
regex Block_Dropbox ".dropbox.com"
access-list URL_Filtering extended permit tcp any any eq www
access-list URL_Filtering extended permit tcp any any eq https
I would like to setup a regex substitution rule. For example with an HTTP response if the work CAT is present I would like to have the ASA change the string to DOG.
This is not the exact problem I want to solve, but it is concept. I am running ASA 8.4.1.
I am running a Cisco ASA 5510 with Trend Micro Interscan. We have it set up to filter https except for a handful of sites. It is filtering the ones we don't want ie: facebook, and youtube. Though it is causing all other https to slow to a crawl. Therefore some sites it times out on us. What should we be looking for to change so it isn't slowing the allowed sites down?
I have come across articles mentioning that URL Filtering can be implemented by using ASA 5505 with URL Filtering Servers. But Websense and other Web Filtering Servers are paid ones ? Are there any free solutions available ? What exactly is N2H2 ? The reason is I don 't want to increase the CPU utilization of ASA by implementing URL filtering within the device. If I have around 30 nodes which connects to the internet via a 2Mbps line through ASA 5505 and if I want to block around say 10 or 15 URLs , will it increase CU utilization beyond permissible limits ? Currently the CPU Utilization is around 10 - 15 . Here's the infrastructure setup .
Just setting up and testing a Cisco 891-K9 router. Used CCP for basic setup, figure I'll tweak any settings needed later.For the firewall, I chose the default "medium" security setting in CCP, then added some holes (already setup in NAT) for outside access in.
Now on to the real question:I noticed that I am now unable to click through google search results. On any borwser. Clicking on any search result simply loops back around to the same google search page. If I disable Javascript on the browser, everything works as expected. So it appears that the firewall is preventing something in google's scripts from redirecting and "clicking through" to the final destination page.
I'm familiar with our old Pix firewall commands, but still a relative newcomer to the zone based firewall and commands for this new 891, (relevant Config pasted below) (Gi0 is the WAN interface)
! ! multilink bundle-name authenticated parameter-map type protocol-info yahoo-servers server name scs.msg.yahoo.com server name scsa.msg.yahoo.com server name scsb.msg.yahoo.com
I have a ASA 5505 as a default gateway to a network, whenever I tracert to outside it shows every hop ip address as the ip address I'm trying to get too, quick example
lets say I'm in a 192.168.0.0/25 network but I want to trace to 10.10.10.10
I use a CISCO ASA 5505 with ASA 8.3. Everything works fine, but when I type the following line I get an error message:
nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5ERROR: 10.1.5.5 doesn't match an existing object or object-groupI even tried to create the missing object but it did not work. The document also explains how to use ASDM for this configuration. It seems that there an object 10.1.5.5. is created.
I've been trying to configured Websense urlfiltering using ZFW feature on my Cisco 881G router. The router is running on IOS 15.0(1)M with Advanced IP Services. And I have confirmed it supports urlfilter feature.
This is what I tried to accomplish but IOS version 15.0x seems to have different command set. ----------------------- class-map type inspect httptraffic match protocol http parameter-map type urlfilter param server vendor websense 10.20.30.40 [Code]...
Could URL FIltering be implemented on Cisco ASA 5505-BUN-k9?i mean to block certain websites, like facebook, youtube, to block certain download files like .exe, .com .bat etc....Is there any extra license needed for this, or it could be done with the simple IOS ASA5505-bun-k9?
I try to implement the url filtering feature on a cisco 2811 router and whenever i enable the parameter map patterns the router retuns (after some time)
%Unable to compile obj regex.[code] The result is that the router blocks ALL webpages without giving a block page message.
I have a problem configuring url filtering on ASA 5505 rel 8.3.1: I have to block the web navigation to facebook and, with my configuration, it works fine.The problem is when I try to access on other sites where there are a links to facebook, I cannot see that site and not only the button of facebook.
One of our customers has an ASA5510 with CSC SSM-10 security module. The software version of the module is 6.6.1125.0.Is it possible to do https filtering with this module ? The customer is complaining that this is not possible...from Cisco I've read the following:
• HTTPS Filtering – Able to allow or block HTTPS traffic. – Supports group-based and user-based HTTPS policies. – Includes URL blocking/URL exception list support for HTTPS domains.
I have ASA 5505 running 7.2.4, I want to prevent users accessing some web sites such as facebook , youtube and hotmail etc.
Which ASA 5505 IOS version should I use to block web access?
I don't want to isntall a dedicated filtering server ( websense etc) , I just want to block web sites statically on ASA 5505 via ASDM as I only have few sites to block.
know if ASA 5505 can do URL filtering, and what IOS is required ?
Does ASA 8.3 support MAC address filtering, I want to allow a single specific laptop to login to the ASA 8.3 firewall (for management) from anywhere on the internet, I know I can do it through VPN but I want a simple MAC address access list or something......
Alright, well I have a Cisco 891w router and have just about everything up and ready to deploy. I'm primarily using Cisco CP 2.4 to provision the router with minor tweaks being done in the CLI. I want to set up a filter to allow access to roughly 20 websites for the majority of my network which is all on the same VLAN. The ip ranges are x.x.x.10 - x.x.x.169 which I have set into a Network Object group called limitac. The second group ranges at x.x.x.170 - x.x.x.199 and is called allowac. I have set up DHCP bindings for all the devices that will connect to the network but I want to set up a web filter for only the first group. I cannot seem to find anything in the Cisco CP manual or the IOS manual for setting up filtering for a range of IPs only. Primarily there are a few computers that need full access to the web while the others should only have access to the sites I set up in the filter.
i am going to implement a ASA5505 in one of my offices. I would like to use web filtering feature on it. Will it cause any performance degradation in ASA? will it utilized more memory?
I have a Cisco SR-520 router which I am trying to configure and install the IOS content filter. I have read many of the documents on this but some of the lines do not work, from using the pages belowURL you are supposed to enter parameter maps as follows:-
parameter-map type trend-global global-param-map server trps.trendmicro.com cache-size maximum-memory 256 cache-entry-lifetime 1
The router has 12.4 (20) T4, which is supposed to be supported, the only other way of configuring is using CCP which is not compatible with SR-520's you recieve hardware not supported message's.
I have big trouble with easyvpn clients access filtering on asaos 8.4.1. I have couple of remote offices with hardware clients (cisco 87x, 88x) configured as easyvpn clients to Asa. Default route in it's routing table pointing to the Virtaul-Access interface (easyvpn connection to ASA), so there is no split tunneling or any kind of nat on the clients. I have ip-telephony deployed across remote offices. This remote offices should be able to call to each other.
On the ASA i have configuration for this purpose: same-security-traffic permit inter-interface same-security-traffic permit intra-interface
But as soon as I configured it, remote users obtain an ability to access Internet without any restrictions although there is couple of access-lists configured on the outside interface pointing to easyvpn clients. Then there is no same-security-traffic commands i can filter out access to internal and external resources correctly, but remote offices can't communicate with each other
I was just wondering if it possable if I could make a server with URL Filtering, Firewall, and a login system.So, when users want to use the internet they are required to login before they do. Is there a program out there?
I know the 5510 & 5520s support the CSC-SSM module for Content Filtering (Anti-Phishing, Anti Spam, URL filtering, Anti-Spyware & Antivirus), but what about content filtering for the ASA5525-K9.The problem that I have is that I need a firewall that supports up to 1 Gbps Maximum Firewall Throughput and to support 250 users with Content Filtering described above.I'm using the following doc for sizing and came across the ASA5525-K9 for 1 Gbps, but not sure about the Content filtering: url...
I have an FWSM running in multiple context mode running 3.2(18) code. I have 3 urls that I would like to block so I can't justify the cost of an external URL filtering server. I have found a way to filter individual URLs on the ASA but the same configuration does not seem to be available on the FWSM. At least not on my code. Any way to do this other than resolving the hostnames and blocking the current IP addresses?
I have one outside interface with global IP address 1.1.1.1 and two inside.Both inside interfaces restrict and non_restrict have private IP addresses.I tried to filter some URLs on PIX515 IOS 7.2, only on restrict interface but my filter does not work.I can access prohibited URL from restrict interface. What's wrong in my URL filtering?
I would like to know how to configure my DIR-600s firewall UDP Endpoint Filtering. I ve read some guides and I ve got to configure this to Endpoint Independent in order to play League of Legends. The problem is that I can see the option Firewall & DMZ but then I don't see the UDP or TCP Endpoint Filtering options.
I am working with a client who is adamant their backbone is fine. However, I am unable to get a single iperf connection to generate anything more than 9.5 megabit/s, and can go all the way up to 322 megabit/s with multiple streams before it looks like we are saturated. Note the example below for a single stream has a 1MByte window, with 8kb we were only able to see 2.4 mbits/sec per stream (as seen in the per stream in the example below). Where would you begin to look for why we cant seem to exceed 2.3mbit/s with an 8kb window, or 7.88 with a 1mbyte.
Im notice after configure the trend micro url filtering on a Cisco 2821 high latency on Http navigation, the latency on the ping for the requests shows a 245ms latency, but if i disable this feature on the router, returns to normal navigation and decrease the latency up to 70ms.
I have Zone Based Firewall running on a 2821 router and would like to configure Url Filtering with Websence . IOS running on that device is c2800nm-adverterprisek9-mz.150-1.M7.bin . Once you have ZBF config you cant configure url-filtering using classic way ( ip inspect ) and this has to be done using class , policy maps .For this to to happen it is required to have match protocol http command under the class map , it wont work using the match access-group command.[code]
Once I put match protocol http command browsing becomes dead slow , also without using match protocol command I cant continue to configure Url Filtering . Is this a problem related to IOS where match protocol command isnt working fine . I have checked CPU utlization of Router and it was roughly near 7 percent .
I am trying to get layer 7 application protocol to work in a simple test setup, I need to get this working to filter roommate traffric . Simple configuration with two interface(inside and outside). With layer application configured, everything works fine, but when applied layer 7 it does not block the web site i want... URL filter and parameter map don't work either...
parameter-map type urlfilter URL-FILTERaudit-trail onparameter-map type regex humoronpattern [Hh][Uu][Mm][Oo][Rr][Oo][Nn][.][Cc][Oo][Mm] parameter-map type regex LAPOSTE1pattern LAPOSTE.NET(code)
I have IOS content filtering using the Trend Micro subscription service working on a 2911 running 15.1.(3)T3 with the security license option and a 30 day demo Trend subscription. Once I figured out that the content filtering for Trend appears to be completely broken in 15.2 (even using docs for 15.2) I went back to 15.1 and it works great.
Everything seems great so far except I would like to have a more 'fancy' or custom blocked page where a user can have a couple links to either go to the trend micro reporting page [URL] or some other page, and maybe some branding so they know the page is coming from our network and is not some fake security thing or phishing attempt or whatever.
I know I can use the 'parameter-map type urlf policy trend ' section to do a tiny bit of customization of the text that appears on the default blocked page display and there is an option for it to go to a simple redirect instead ('block-page redirect -url') but how to do more with either the built in page or the redirect- url to keep the information of what page the user was trying to access and why it was blocked (category etc.) while adding more features.
Oh, one last thing, this doesn't support any kind of 'user override' or anything like that does it? So that a network can have a filter applied but an admin could override the filtering to allow temporary access to something?
