Cisco PIX 525 Especificaciones descargar pdf (Pagina 288)

100

101

17-8

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 17 Applying Filtering Services

Filtering HTTPS URLs

The allow option causes the security appliance to forward HTTP traffic without filtering when the

primary filtering server is unavailable. Use the proxy-block command to drop all requests to proxy

servers.

Enabling Filtering of Long HTTP URLs

By default, the security appliance considers an HTTP URL to be a long URL if it is greater than 1159

characters. For Websense servers, you can increase the maximum length allowed.

(Websense only) Configure the maximum size of a single URL with the following command:

hostname(config)# url-block url-size

long-url-size

Replace long-url-size with a value from 2 to 4 for a maximum URL size of 2 KB to 4 KB. The default

value is 2.

Truncating Long HTTP URLs

By default, if a URL exceeds the maximum permitted size, then it is dropped. To avoid this, you can set

the security appliance to truncate a long URL by entering the following command:

hostname(config)# filter url [longurl-truncate | longurl-deny | cgi-truncate]

The longurl-truncate option causes the security appliance to send only the hostname or IP address

portion of the URL for evaluation to the filtering server when the URL is longer than the maximum

length permitted. Use the longurl-deny option to deny outbound URL traffic if the URL is longer than

the maximum permitted.

Use the cgi-truncate option to truncate CGI URLs to include only the CGI script location and the script

name without any parameters. Many long HTTP requests are CGI requests. If the parameters list is very

long, waiting and sending the complete CGI request including the parameter list can use up memory

resources and affect firewall performance.

Exempting Traffic from Filtering

To exempt specific traffic from filtering, enter the following command:

hostname(config)# filter url except

source_ip

source_mask dest_ip

dest_mask

For example, the following commands cause all HTTP requests to be forwarded to the filtering server

except for those from 10.0.2.54.

hostname(config)# filter url http 0 0 0 0

hostname(config)# filter url except 10.0.2.54 255.255.255.255 0 0

Filtering HTTPS URLs

You must identify and enable the URL filtering server before enabling HTTPS filtering.

Note Filtering HTTPS URLs is only supported for Websense filtering servers.

1 2 ... 283 284 285 286 287 288 289 290 291 292 293 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 288

Comentarios a estos manuales