Cisco PIX 525 Especificaciones descargar pdf (Pagina 289)

17-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 17 Applying Filtering Services

Filtering FTP Requests

Because HTTPS content is encrypted, the security appliance sends the URL lookup without directory

and filename information. When the filtering server approves an HTTPS connection request, the security

appliance allows the completion of SSL connection negotiation and allows the reply from the web server

to reach the originating client. If the filtering server denies the request, the security appliance prevents

the completion of SSL connection negotiation. The browser displays an error message such as “The Page

or the content cannot be displayed.”

Note The security appliance does not provide an authentication prompt for HTTPS, so a user must

authenticate with the security appliance using HTTP or FTP before accessing HTTPS servers.

To enable HTTPS filtering, enter the following command:

hostname(config)# filter https

port localIP local_mask foreign_IP foreign_mask

[allow]

Replace port with the port number if a different port than the default port for HTTPS (443) is used.

Replace local_ip and local_mask with the IP address and subnet mask of a user or subnetwork making

requests. Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server or

subnetwork responding to requests.

The allow option causes the security appliance to forward HTTPS traffic without filtering when the

primary filtering server is unavailable.

Filtering FTP Requests

You must identify and enable the URL filtering server before enabling FTP filtering.

Note Filtering FTP URLs is only supported for Websense filtering servers.

When the filtering server approves an FTP connection request, the security appliance allows the

successful FTP return code to reach originating client. For example, a successful return code is “250:

CWD command successful.” If the filtering server denies the request, alters the FTP return code to show

that the connection was denied. For example, the security appliance changes code 250 to “550 Requested

file is prohibited by URL filtering policy.”

To enable FTP filtering, enter the following command:

hostname(config)# filter ftp

port localIP local_mask foreign_IP foreign_mask

[allow]

[interact-block]

Replace port with the port number if a different port than the default port for FTP (21) is used. Replace

local_ip and local_mask with the IP address and subnet mask of a user or subnetwork making requests.

Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server or subnetwork

responding to requests.

The allow option causes the security appliance to forward HTTPS traffic without filtering when the

primary filtering server is unavailable.

Use the interact-block option to prevent interactive FTP sessions that do not provide the entire directory

path. An interactive FTP client allows the user to change directories without typing the entire path. For

example, the user might enter cd ./files instead of cd /public/files.

1 2 ... 284 285 286 287 288 289 290 291 292 293 294 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 289

Comentarios a estos manuales