PIX as full web proxy server? Can it be done?

[0r8it]

Hi all,

I'm probably going to log a TAC call for this, but on the off chance that anyone knows...

I'm swapping out a Checkpoint unit for a 515E. The Checkpoint acts as the proxy server for web access for all of our users. If a user wants to see, for example, www.bbc.co.uk, Checkpoint knows how to go off and fetch external dns for this record, and then goes off and returns the page (if available, obviously).

But, is it possible to something like this on the PIX? I know it will operate as a local/radius/tacacs+ http authenticator in cut-through proxy mode, but will it also fetch dns?

Any thoughts?

regards,

Gary

[grant.maynard]

PIX will not act as DNS server, proxy server or web cache. I didn't know CheckPoint did that either - surely something else on the same box was doing that.

PIX will allow this traffic through, you could do user auth on the PIX, PIX will do NAT, and you could use an external URL filter such as WebSense or N2H2.