Cisco PIX 525 Spécifications télécharger pdf (Page 145)

3-33

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Filtering Outbound Connections

When a user issues an HTTP request to a website, the PIX Firewall sends the request to the web server

and to the filtering server at the same time. If the filtering server permits the connection, the PIX

Firewall

allows the reply from the website to reach the user who issued the original request. If the filtering server

denies the connection, the PIX

Firewall redirects the user to a block page, indicating that access was

denied. The PIX

Firewall sends an authenticated user name, a source IP address, and a destination IP

address to the filtering server for URL validation and logging purposes.

Note URL filtering only may considerably increase access times to web sites when the filtering server is

remote from the PIX Firewall.

Identifying the Filtering Server

You identify the address of the filtering server using the form of the url-server command appropriate

for the type of filtering server you are using.

For Websense:

pix(config)# url-server [(if_name)] host local_ip [timeout seconds] [protocol TCP [version

1 | 4] | UDP]

For N2H2:

pix(config)# url-server [(if_name)] vendor n2h2 host local_ip[:port number] [timeout

<seconds>] [protocol TCP | UDP]

Replace if_name with the name of the PIX Firewall interface on which you are enabling filtering.

Enclose the interface name within parentheses, as in the following example:

url-server (inside) host 192.168.1.1

By default, if you do not include this parameter, filtering will apply to the inside interface.

Replace local_ip with the IP address of the filtering server. Replace seconds with the number of seconds

the PIX

Firewall should wait before giving up on connecting to the filtering server.

Use the protocol option to identify whether you want to use TCP or UDP. With a Websense server, you

can also specify the version of TCP you want to use. TCP version 1 is the default. TCP version 4 allows

the PIX

Firewall to send authenticated usernames and URL logging information to the Websense server,

if the PIX

Firewall has already authenticated the user.

Note URL filtering may considerably increase access times to web sites when the filtering server is remote

from the PIX Firewall.

You can identify more than one filtering server by entering the url-server command multiple times. The

primary filtering server is the first server that you identify. If you want to change your primary server,

use the no url-server command with the address of your primary filtering server. Then issue the

url-server command with the address of your primary server.

Note If you switch the url-server type after configuration, the existing url-server configurations are dropped

and you must reenter the configuration for the new filtering server type.

1 2 ... 140 141 142 143 144 145 146 147 148 149 150 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 145

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525