Cisco PIX 525 Spécifications télécharger pdf (Page 150)

3-38

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Filtering Outbound Connections

Configuration Procedure

Perform the following steps to filter URLs:

Step 1 Identify the address of the filtering server with the url-server commands:

For Websense:

# url-server [(if_name)] host local_ip [timeout seconds] [protocol TCP | UDP version 1|4]

For N2H2:

# url-server [(if_name)] vendor n2h2 host local_ip[:port number] [timeout seconds]

[protocol TCP | UDP]

Replace if_name with the name of the PIX Firewall interface that is connected to the filtering server (the

default is inside). Replace local_ip with the IP address of the filtering server. Replace seconds with the

number of seconds the PIX

Firewall should wait before giving up on connecting to the filtering server.

Note The default port is 4005. This is the default port used by the N2H2 server to communicate to the

PIX

Firewall via TCP or UDP. For information on changing the default port, please refer to the

Filtering by N2H2 Administrator's Guide.

For example:

url-server (perimeter) host 10.0.1.1

url-server (perimeter) vendor n2h2 host 10.0.1.1

The first command identifies a Websense filtering server with the IP address 10.0.1.1 on a perimeter

interface of the PIX

Firewall. The second command identifies an N2H2 server at the same interface and

address.

Step 2 Configure your filtering policy with the following command:

filter url [http | port[-port] local_ip local_mask foreign_ip foreign_mask] [allow]

[proxy-block]

Replace port with one or more port numbers if a different port than the default port for HTTP (80) is

used. Replace local_ip and local_mask with the IP address and subnet mask of a user or subnetwork

making requests. Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server

or subnetwork responding to requests.

The allow option causes the PIX Firewall to forward HTTP traffic without filtering when the primary

filtering server is unavailable. Use the proxy-block command to drop all requests to proxy servers.

For example:

filter url http 0 0 0 0

filter url except 10.0.2.54 255.255.255.255 0 0

The first command filters all HTTP traffic. The second command exempts all requests from 10.0.2.54

from filtering restrictions.

Note Step 3 through Step 6 only work with PIX Firewall Version 6.2 or higher. Buffering URLs longer

than 1159 bytes is only supported for the Websense filtering server.

1 2 ... 145 146 147 148 149 150 151 152 153 154 155 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 150

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525