Hi guys. I am relatively new to PIX/ASA and am still learning my way around it. The thing is I came into a company where the IT infrastructure is pretty much setup already and management wishes to retain the current setup and are only open to small configuration changes in the switch and ASA. We have an L3 core switch which goes through an ASA and out to the ISP provider. We also have an alternative route going to another router. My problem primarily is with https. We have a route map that redirects www packets to a transparent squid proxy but https filtering won't work with squid setup as a transparent proxy. I cannot add route-map sequence to block 443 because there are several https sites that i need to allow for users and we had a cpu utilization concern previously and the cause was the route-map. That leaves with me with only the PIX. I did some further research and there were some mention that the ASA/PIX couldn't filter https traffic. I don't know if this is true. Anyway, I am desperate. Effectively restricting https traffic would require a major reconfiguration of the acls, routemaps and PAT involving several switches and routers.
I would appreciate any assistance and advice regarding this.
The PIX/ASA can filter HTTP/HTTPS/JAVA/FTP/etc requests using 3rd party vendors such as Websense, N2H2, etc.
You would need to purchase one of these software solutions and then redirect any HTTP/HTTPS/FTP requests the PIX/ASA receives to Websense. This is done using the 'filter url' and 'filter https' options. You then control web content, policies, users from within Websense.
You can look into using regex. The problem with this is that it's by domain, so if you only allow certain domains through, it wouldn't be too bad. But Cisco only supports N2H2 and Websense as external web filters unfortunately.
Just to add to that, you can also use the CSC module which works with the ASA 5510 an up I believe.... It allows the ASA to offload SMPT,HTTP and FTP traffic to an onboard module for URL, SPAM, Anti X filtering etc etc..... Take a look...
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :