Cisco Switching/Routing :: 871 Content Filtering At Specific Time And Multiple Adsl Connections
Jan 23, 2013
I have Cisco 871 router with 12.3. OS version.
1. I'm interested if it's possible to block certain contetn only at certain time ? e.g. We would like to block facebook from 7:00 to 10:00 and from 11:00 to 15:00. I was going through cisco manuals but can't find the right answer to this.
2. Cisco 871 has 4 LAN interfaces and one WAN interface. Currently WAN interface is connected to adsl modem in bridge mode and LAN 0 interface is connected to switch.
I'm interested if I could use remaining 3 LAN interfaces for adsl connections same as I'm using WAN interface. Then I would create vlans that would use LAN interface 0. Each of those VLAN's would use different adsl connection.I would assign different IP to each VLAN's so users would be able to change their gateway and use different ADSL connection.
I have laptop with windows 7 ultimate.i have two internet connection avalable...
1> wifi network of my office...which is protected by cyberom..so i cant open facebook and other restricted sites
2> internet through my android mobile...which is dialup connection or through usb tethering
i want to use office wifi for downloading via idm or other download manager and my mobile internet for social networking..or any idea i allow application to connect internet via perticuler network/way..
Modem: WRT310N Firmware: 220.127.116.11 Build 4 (Latest)If I want to allow Multicast traffic on my network, does this box need a "Check Mark" or does it need to be "Unchecked".Filter Multicast Multicasting allows for multiple transmissions to specific recipients at the same time. Ifmulticasting is permitted, then the Router will allow IPmulticast packets to be forwarded to the appropriatecomputers. Select this feature to filter multicasting. Thisfeature is not selected by default. Filter Multicast. Multicasting allows for multiple transmissions to specific recipients at the same time. If multicasting is permitted, then the Router will allow IP multicast packets to be forwarded to the appropriate computers. Select Enabled to filter multicasting, or Disabled to disable this feature.
WRT610N Manual: Filter Multicast Multicasting allows for multipletransmissions to specific recipients at the same time. Ifmulticasting is permitted, then the Router will allow IPmulticast packets to be forwarded to the appropriatecomputers. It is selected by default. Deselect this featureto disable it.
WRT54G2 Manual: Filter Multicast Multicasting allows for multipletransmissions to specific recipients at the same time. Ifmulticasting is permitted, then the Router will allow IPmulticast packets to be forwarded to the appropriatecomputers. This feature is selected by default. Deselectthis feature to disable it.
I have a Cisco SR-520 router which I am trying to configure and install the IOS content filter. I have read many of the documents on this but some of the lines do not work, from using the pages belowURL you are supposed to enter parameter maps as follows:-
parameter-map type trend-global global-param-map server trps.trendmicro.com cache-size maximum-memory 256 cache-entry-lifetime 1
The router has 12.4 (20) T4, which is supposed to be supported, the only other way of configuring is using CCP which is not compatible with SR-520's you recieve hardware not supported message's.
I'm looking for a content filtering/antivirus/antispyware appliance for my company. Right now we have an ASA 5505 at the edge. We have several outside employees connecting via Cisco VPN clients to the ASA. I need an appliance that can do content filtering for my inside network, guest network, and VPN users. That's two local VLANs and a VPN pool which are all terminated at the ASA.
I've had good luck with Cymphonix in the past, but their boxes are a bit steep for the amount of throughput I need. We'll probably be moving from a 15/15 fiber connection to 80/10 cable soon since our provider can't seem to keep us online; even with an alleged "100%" SLA. They just don't have a network capable of anything close to 100% uptime, plain and simple.
I'd like to keep the ASA running as our firewall and VPN server, so the device needs to be able to do content filtering/av/as in a transparent mode.
I know the 5510 & 5520s support the CSC-SSM module for Content Filtering (Anti-Phishing, Anti Spam, URL filtering, Anti-Spyware & Antivirus), but what about content filtering for the ASA5525-K9.The problem that I have is that I need a firewall that supports up to 1 Gbps Maximum Firewall Throughput and to support 250 users with Content Filtering described above.I'm using the following doc for sizing and came across the ASA5525-K9 for 1 Gbps, but not sure about the Content filtering: url...
We have just buy a Cisco Small Business Router, model RV082. I need to enable the content filtering, but we just realized that this equipment does not filter HTTPS urls, even with the solution "Cisco ProtectLink Web" the equipment does not filter HTTPS urls.
For example, if I type on my browser just [URL], the access blocked, but if I type HTTPS:[URL], the access is allowed!Is there any way to block urls with HTTPS?
I am a fairly basic configs that I just can’t figure out what I am doing wrong. I have what I would consider a fairly basic config that I just can’t seem to get to work and I am sure it is something I am just not doing or grasping. Basically I have two 3560 switches that I would like to connect together with four 1Gb ports and trunk four vlans across said port-channel, I created the port-channel and set it to switchport trunk encapsulation dot1q I then set all four ports to channel-group # mode on. With that setup I can’t ping from switch to switch on the nonnative vlan.
is it possible to shutdown a specific port on my 3750x and monitor this port at the same time .for example , im dealing with a mac authenticated network using port security , i want to shut down all the ports that are not used at the moment , however , if some one gets connected to the one of the shutdown ports i want to know the mac address of the user or atleast to know that i have someone who is just plugged in to the one of the shutdowned ports .
I have IOS content filtering using the Trend Micro subscription service working on a 2911 running 15.1.(3)T3 with the security license option and a 30 day demo Trend subscription. Once I figured out that the content filtering for Trend appears to be completely broken in 15.2 (even using docs for 15.2) I went back to 15.1 and it works great.
Everything seems great so far except I would like to have a more 'fancy' or custom blocked page where a user can have a couple links to either go to the trend micro reporting page [URL] or some other page, and maybe some branding so they know the page is coming from our network and is not some fake security thing or phishing attempt or whatever.
I know I can use the 'parameter-map type urlf policy trend ' section to do a tiny bit of customization of the text that appears on the default blocked page display and there is an option for it to go to a simple redirect instead ('block-page redirect -url') but how to do more with either the built in page or the redirect- url to keep the information of what page the user was trying to access and why it was blocked (category etc.) while adding more features.
Oh, one last thing, this doesn't support any kind of 'user override' or anything like that does it? So that a network can have a filter applied but an admin could override the filtering to allow temporary access to something?
I face a strange bahavior with my rv220w router : I set up access rules to deny all outbound trafic for a particular IP range. It seems to work fine .... but when I enable content filtering, HTTP access on port 80 works again (and other ports are denied). It seems that activating content filtering makes the router ignore firewall rule.
I'm working withbusiness set up a remote office, currently with about 45 PC's that could grow in the future. They are looking at a RV042G or (for long term future growth) a ISA570.They want to be able to do content filtering by category, ie restrict gambling, drugs, etc. sites rather than by URL or addresses.Is either the RV042G or the ISA570 capable of doing this?Are both routers to be available long term? ie, they are not on any end-of lists? I've looked and did not see them on any.Is the RV042G capable of handling an office even starting with 45 PC's? If not, is the 570 a good fit?
I found an interesting manual at this forum for blocking websites whits local content filtering. After I've modified the variables to get more details, I stopped at on question. My current Problem is "zone-pair.
zone security Z-SECRUTIY-SOURCE zone security Z-SECRUTIY-DESTINATION zone-pair security ZP-SECURITY source Z-SECRUTIY-SOURCE destination Z-SECRUTIY-DESTINATION service-policy type inspect CM-INSPECT-TRAFFIC
I have two devices: One is a Linksys WRG54G router. The other is a PC running the Smoothwall router software with URL filtering. Either would work fine on its own as a router. I'm wanting to use them both, though, because each offers different features.Right now, the Linksys router is connected to the WAN and is my DHCP server. Its IP is 192.168.0.1. The Smoothwall box has a static IP of 192.168.0.2. I want all web traffic to go through Smoothwall (192.168.0.2) because it offers good web filtering.
I know I could use Smoothwall as my router and rid of the Linksys, but the whole idea behind this is to use the QoS and other features that Linksys firmwares offer (such as Tomato or DD-WRT), but still keep the ability to filter URLs.
content My_Group add service blade1 add service blade2 add service blade3 vip address 18.104.22.168 advanced-balance arrowpoint-cookie
So I have 3 blades which are proxy servers and user go first to an MS ISA server then the VIP of the CSS and then the rules processes them give them a blade and chuck them out onto the Internet.
I want to leave the above rule, but remove one blade create an additional content group with that blade and have it process requests for a particular site so, I would create the following
content My_Group2 add service blade3 vip address 22.214.171.124 advanced-balance arrowpoint-cookie
So my question is can I do that having the same VIP's etc so if a request comes in and it matches www.thewebsite.com that the second content rule matches it 'better' and therefore processes it or would it still be caught by the "/*" content group. I don't want to create more VIPS as I have a real ache getting firewall rules done.
I have an issue with the device in subject. I need that some server, listed as service on CSS, can contact a content VIP on the same subnet. To allow that traffic I configured grouping on CSS (group 1) with vip address and an ACL that allow traffic from subnet 10.1.1.0/24 toward same subnet 10.1.1.0/24 and I have bound this ACL with sourcegroup 1. The nat and portmap works but never at first attempt, instead since second attempts it works. Seem like a CSS require to much time to create nat entry.
I would like configure a CSS content, that uses the sorry service principal in an advanced way.
I am familiar with the primary Sorry Server command and see that the CSS would send all connections to the named service that is configured as the primary Sorry Server.
What I would like to do is to configure the CSS, so that once it’s decided it’s in a “sorry” state (all the services that are configured with “add service” are down) that it load balances to a different set of services.
To explain what I’ve been trying to do in the form of configuration on the CSS, I’ve pasted some pretend config below.
Connections come into IP address 126.96.36.199, which normally get load balanced between 188.8.131.52, 184.108.40.206 and 220.127.116.11.
If 18.104.22.168, 22.214.171.124 and 126.96.36.199 are all down, the sorry service is used and the CSS starts passing traffic to 188.8.131.52, which I want it to load balance between 184.108.40.206, 220.127.116.11 and 18.104.22.168.
The order that I have applied the config, is different to the below, as I set out to configure in this order: secondary services, secondary content, sorry service, primary services, primary content.
The order of the config below is different, because I wanted it in the order that the traffic flows and the CSS won’t take the config in that order!
The wall I have ran into, is that when I try to create the service I have named “Sorry Service”, I get the following error:
%% Service IP Address conflicts with a local I/F, VIP, mg mt route.
I have the need to filter multicast between vlans as described below. PIM Sparse-Mode is being utilized for this multicast network and changing any Vlan to PIM Dense mode is not an option.
- Vlan 217 and Vlan 4 should not be communicating on mcast with any other vlan, including eachother (each vlan isolated).
-Vlan 64 and Vlan 80 are able to communicate witch each other on mcast but not with any other vlans (isolated vlan group).
-All other vlans can communicate mcast freely.
What I've created thus far is below. It does not appear to be the most elegant solution and would be difficult for the administrators to adjust as new requirements come along. Yes, I will be adding the appropriate link-local multicast addresses so as to not break routing and other dependent technologies.
ip access-list ext ANY_CONN permit ip any any ip access-list ext MCAST_INTRA_217 permit ip 22.214.171.124 126.96.36.199 188.8.131.52 255.255.224.0 permit ip 184.108.40.206 255.255.224.0 220.127.116.11 18.104.22.168 ip access-list ext MCAST_ISOLATE
Probably an easy fix but something's weird in my config. I am setting up a new network, so this is not production, Routed environment, down to the access layer using 3560-x l3 switches.
vlan 10: data vlan 20: wifi vlan 30: wifi guests vlan 40: voip
My objective is to allow all traffic OUTBOUND to certain subnets (10.10.0.0/24, 10.10.100.0/24, 10.10.110.0/24 10.10.120.0/24) and block any other 10.0.0.0/8 networks. By doing it this way, after blocking all other internal traffic, I allow everything else to ensure internet traffic can go out.
Extended IP access list VLAN10_TRAFFIC_FLOW 10 permit ip any 10.10.0.0 0.0.0.255 20 permit ip any 10.10.100.0 0.0.0.255 30 permit ip any 10.10.110.0 0.0.0.255 40 permit ip any 10.10.120.0 0.0.0.255 50 deny ip any 10.0.0.0 0.255.255.255 (5 matches) 60 deny ip any 172.16.0.0 0.0.255.255 70 permit ip any any!interface Vlan10description DATAip address 10.104.10.1 255.255.255.0ip access-group VLAN10_TRAFFIC_FLOW outendThe problem is, from the above info, when I ping 10.10.0.5 from a workstation in VLAN 10, it should match rule 10, but instead if matches rule 50 (as shown by the 5 matches)
Trying to control capacity utilization for guest users connecting to a 2960 switch. No problem for IPv4 users, but IPv6 is giving me fits. What I've found out by trial and error so far implies that there is just enough IPv6 smarts in a WS-C2960-24TT-L running c2960-lanbasek9-mz.150-1.SE to make it impossible to control IPv6 traffic. Blocking IPv6 would be sufficient short term, but MAC filtering on type 0x86DD does not appear to work either. Here are the results I've gotten so far:
* Protocol ipv6 or an IPv6 ACL in a class map.
* Using a class map referencing ipv6 protocol or an ipv6 ACL in a policy map.
* IPv4 inbound filters and policing.
* Blocking of IPv4 traffic by a MAC ACL blocking type 0x0800 (IPv4) - note that the docs explicitly state that MAC filters do NOT filter IP traffic, except for on this box on this release they do.
What does not work:
* Applying a policy map referencing a class map referencing protocol ipv6 or an IPv6 ACL to an interface. The service policy is accepted by the parser, but is not inserted into the running configuration.
* "class-default" in a policy map only matches IPv4 traffic, not all other traffic.
* Blocking of IPv6 traffic by a MAC ACL blocking type 0X86DD. No problem applying the access-group to the interface, it just doesn't do anything.
I am aware that this box is not supposed to support IPv6 other than for multicast, but as implemented, this is a hole an abuser could drive a MAC truck through.
Is this situation unique to this particular 2960 switch or SW release (I also tried 12.2(58)SE2) or does it afflict all 2960's running LANbase?
Assuming the answers to the first two question are negative, what is the minimum requirement to get working IPv6 policing in an edge switch?
How filter inbound routes in Cisco ASA OSPF? Because Cisco ASA has no "distibute-list" command for OSFP process configuration, I try to use "filter-list" command in area definition. So, I try to use next configuration:
I was wondering if i can enable url filtering on my 2691 or 2651XM routers so that if someone visits any website i can see that under router logs. right now i am using kiwi syslog that logs the router activities.
How to configure Belkin N (F5D8636-4) Client IP Filtering so that a range of client IP' deny access to the internet using the following blocked time ranges e.g. Mon 5:00pm to Tues 2:00pm, Tues 5:00pm to Wed 2:00pm, Wed 5:00pm to Thur 2:00pm, Thur 5:00pm to Fri 2:00pm, Fri 5:00pm to Sat 10:00am, Sat 1:00pm to Sun 10:00am, Sun 1:00pm to Mon 2:00pm - BTW - this access regime is to deny internet access for my teenage son?
I have an ASA 5510, with Ethernet0 connected to Internet via a T1 line, Ethernet1 connected to LAN1, and Ethernet2 connected to LAN2. LAN1 & LAN2 are independant, but share the Internet connection, via the T1 line. On LAN2, I have another router that connects to the Internet, via a Comcast line. I wish to route some of the traffic on LAN2 (10.38.77.0) to the other Router, on LAN2 (10.38.77.12) (connected to the Comcast line). I have entered the following lines:
I am attempting to filter a specific host(s) from my OSPF routiing table on a ASA 5550 (ABR) using LSA prefix lists. However, when I look at the other routers in that area, I notice that ALL LSA type-3's are being removed (10 hosts are now missing from the routing table). I have verified the filter is working on the ABR, but I can't figure why ALL hosts/routes that were coming into the area are now being filtered instead of the specific one that I want to filter out.
Here is the config on the ABR:
prefix-list pdm_pl_000 seq 10 permit 22.214.171.124/32 ! ! router ospf 1 network 10.0.0.0 255.255.255.0 area 0 network 10.150.10.0 255.255.255.0 area 10 network 10.150.252.0 255.255.255.224 area 10
The 126.96.36.199 host is actually coming from Area '3'. Am I doing something that is removing all type-3 LSA's?