Cisco PIX 525 Especificaciones descargar pdf (Pagina 284)

100

101

17-4

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 17 Applying Filtering Services

Filtering with an External Server

The following example blocks downloading of Java applets to a host on a protected network:

hostname(config)# filter java http 192.168.3.3 255.255.255.255 0 0

This command prevents host 192.168.3.3 from downloading Java applets.

To remove the configuration, use the no form of the command, as in the following example:

hostname(config)# no filter java http 192.168.3.3 255.255.255.255 0 0

Filtering with an External Server

This section provides an overview of filtering with an external server and describes the configuration

required regardless of the type of server you are using or the type of content you are filtering. This

section includes the following topics:

• Filtering Overview, page 17-4

• General Procedure, page 17-5

• Identifying the Filtering Server, page 17-5

• Buffering the Content Server Response, page 17-6

• Caching Server Addresses, page 17-7

Filtering Overview

You can apply filtering to connection requests originating from a more secure network to a less secure

network. Although you can use ACLs to prevent outbound access to specific content servers, managing

usage this way is difficult because of the size and dynamic nature of the Internet. You can simplify

configuration and improve security appliance performance by using a separate server running one of the

following Internet filtering products:

• Websense Enterprise for filtering HTTP, HTTPS, and FTP.

• Sentian by N2H2 for filtering HTTP only. (Although some versions of Sentian support HTTPS, the

security appliance only supports filtering HTTP with Sentian.)

Although security appliance performance is less affected when using an external server, users may notice

longer access times to websites or FTP servers when the filtering server is remote from the security

appliance.

When filtering is enabled and a request for content is directed through the security appliance, the request

is sent to the content server and to the filtering server at the same time. If the filtering server allows the

connection, the security appliance forwards the response from the content server to the originating client.

If the filtering server denies the connection, the security appliance drops the response and sends a

message or return code indicating that the connection was not successful.

If user authentication is enabled on the security appliance, then the security appliance also sends the user

name to the filtering server. The filtering server can use user-specific filtering settings or provide

enhanced reporting regarding usage.

1 2 ... 279 280 281 282 283 284 285 286 287 288 289 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 284

Comentarios a estos manuales