URL filtering ACE after description of SSL traffic

We currently have a Cisco CSS11501 which we have configured with SSL offloading.
We offload the SSL traffic and after description of the ssl traffic we perform URL filtering.
Can the Ace 4710 Appliance do the same?
I have attached the current configuration of the css.
Regards,
Richard

With the below config
Traffic matching 10.10.10.10:443 will be SSL offloaded and then
will be loadbalanced using rservers in Serverfarm "APP1-SFARM" if
the request includes "/matchthis".
ssl-proxy service APP1-SSL-PROXY
key default-key.pem
cert default-cert.pem
class-map match-all APP1-443-VIP
2 match virtual-address 10.10.10.10 tcp eq https
class-map type http loadbalance match-any APP1-URLMAP
2 match http url /matchthis.*
policy-map type loadbalance first-match APP1-Policy
class APP1-URLMAP
serverfarm APP1-SFARM
policy-map multi-match VIPS-VLAN79
class APP1-443-VIP
loadbalance vip inservice
loadbalance vip icmp-reply active
loadbalance policy APP1-Policy
ssl-proxy server APP1-SSL-PROXY
HTH
Syed iftekhar Ahmed

Similar Messages

SSL traffic management

I am trying to setup a CSS w/SSL module for a company with 1 public IP and 3 internal Web servers (Time Management, Exchange and a employee portal) that require SSL connections. I am NATing all 443 traffic to a CSS VIP which is referencing a SSL-PROXY-LIST (frontend and backend ssl) Does anyone have a network setup like this working?
I am having an issue with URL filtering on the unencrypted clear text traffic/second content rule lookup from the SSL module to the CRM during the Backend SSL setup. Any ideas .. This should be possible ..Correct?
Thanks in advance ...

Got it working ...

ACE Best Sticky Method for SSL Traffic

Hi, With ACE 4710 running serverfarms primarily running SSL traffic, what is the best method for configuring stickiness. Here are some parameters:
1) low volume sites, 2 real servers
2) ACE _will not_ do SSL offloading
3) Balancing HTTPS requests
4) Many versions of HTTP clients
5) Currently running ACE A1 code
I am thinking of:
1) TCP Header | HostID inspection
2) SSL-session ID (not good if re-key often though)
3) Any suggestions?
many thx,
WR

Hi Will,
You can see a comple configured example for your perusal in this regard for
Configure ACE Module for End to End SSL Termination
http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00809c6f37.shtml
And Many more here regarding
Data Center Application Services Configuration Examples:
http://docwiki.cisco.com/wiki/Category:Data_Center_Application_Services_Configuration_Examples
Hope these configuration examples will be useful to you.
Sachin Garg

ZBF URL filtering Issue

Hello. I have the following problem. I try to implement the url filtering feature on a cisco 2811 router and whenever i enable the parameter map patterns the router retuns (after some time)
%Unable to compile obj regex...
My config is
parameter-map type urlfpolicy local URLFILTER
alert off
block-page message "THE REQUEST WAS BLOCKED BY YOUR ROUTER FIREWALL"
parameter-map type urlf-glob ALLOW-URL
pattern *.cisco.com
pattern cisco.com
parameter-map type urlf-glob DENY-URL
pattern *
class-map type urlfilter match-any ALLOW-URL
match server-domain urlf-glob ALLOW-URL
class-map type urlfilter match-any DENY-URL
match server-domain urlf-glob DENY-URL
class-map type inspect match-all INSPECT-HTTP
match protocol http
policy-map type inspect urlfilter URL-FILTER
parameter type urlfpolicy local URLFILTER
class type urlfilter ALLOW-URL
allow
class type urlfilter DENY-URL
reset
log
policy-map type inspect IN-OUT
class type inspect VPN-TRAFFIC
inspect
class type inspect INSPECT-HTTP
inspect
service-policy urlfilter URL-FILTER
class type inspect INTERNET-TRAFFIC
inspect
class class-default
drop
The result is that the router blocks ALL webpages without giving a block page message. Any help would be greatly appreciated.

I have same problem. Reboot router don't help me. Firewall allow all traffic and blocked url too.

ProtectLink Web Protect URL Filtering not working

Good day!
Please help.
We have a problem on our RV042 router.
The Protectlink WebProtect URL filtering is not working.
When we first activate the service (Nov. 12), it worked for a few days, then 2 days ago, our internet connection got problems. But yesterday, our ISP fix the problems on our internet connection, but the URL filtering of WebProtect is not working anymore even if it is enable, up to this time.
What should we do about this problem?
Thanks in advance for your kind replies!

i have installed TMG 2010 and created url filtering rule for facebook.com but that problem
is ever after five minutes i can see that the users can access facebook. and then i check in TMG MMC so i can see that the Category Query says me that facebook.com is unknown....but just after five minutes i can see facebook has been automatically blocked
and i can also see in Category Query it says me facebook is in blog/wiki category...
so why it is changing automatically every after 5 or 10 minutes :( ?
where is the problem ???
i need your help please !!

PIX515 URL filtering doen't work

Dear collegues,
I have one outside interface with global IP address 1.1.1.1 and two inside.
Both inside interfaces restrict and non_restrict have private IP addresses.
I tried to filter some URLs on PIX515 IOS 7.2, only on restrict interface but my filter does not work.
I can access prohibited URL from restrict interface.
Could you tell me what's wrong in my URL filtering?
Here is my config:
PIX Version 7.2(2)
hostname pixfirewall
enable password 8Ry2YjIyt7RRXU24 encrypted
names
interface Ethernet0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.252
interface Ethernet1
nameif restrict
security-level 50
ip address 192.168.2.1 255.255.255.128
interface Ethernet2
nameif non_restrict
security-level 100
ip address 192.168.2.129 255.255.255.192
passwd 2KFQnbNIdI.2KYOU encrypted
regex domainlist1 "\.facebook\.com"
regex domainlist2 "\.twitter\.com"
regex domainlist3 "\.youtube\.com"
ftp mode passive
access-list inside_mpc extended permit tcp any any eq www
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
nat (restrict) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
class-map type regex match-any DomainBlockList
match regex domainlist1
match regex domainlist2
match regex domainlist3
class-map inspection_default
match default-inspection-traffic
class-map type inspect http match-all BlockDomainsClass
match request header host regex class DomainBlockList
class-map httptraffic
match access-list inside_mpc
policy-map type inspect http http_inspection_policy
parameters
protocol-violation action drop-connection log
class BlockDomainsClass
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
policy-map inside-policy
class httptraffic
inspect http http_inspection_policy
service-policy global_policy global
service-policy inside-policy interface restrict
end

Hi,
can you try inspecting http.
Regards.
Alain

URL filtering replacing with web usage control

I come to know the URL filtering in ironport is replacing with the advanced web usage control. May i know from which version its introducing? Any upgradation procedure?
What are the changes will take place after the upgradation & what kind of functionality will be available with Web Usage Control.
Please clarify in detail.
Thanks in advance
Siva

I don't remember when the web Usage controls was introduced... I'm going to guess 7.0?
To upgrade your box to the the current version, click on System Administration>System Upgrade. Click on the Available Upgrades and see what's available for your hardware. If nothing is there, contact your reseller.
Review the release notes for the version you want to upgrade to. http://www.cisco.com/en/US/products/ps10164/prod_release_notes_list.html
Select the version you want, check the box to save the config, you can also have it email you the config. Make sure to uncheck the "Mask passwords..." so that if you have to reload this config on something, it works properly.
There are a huge number of changes in how web usage control works, and the visibility it gives you into what apps users are using and how those applications work. Far to many to go into here. Look at this document:
Chapter 18. http://www.cisco.com/en/US/docs/security/wsa/wsa7.5/user_guide/WSA_7.5.0_UserGuide.pdfhttp://www.cisco.com/en/US/docs/security/wsa/wsa7.1/user_guide/Cisco_IronPort_AsyncOS_7.1.0_User_Guide_for_Web_Security_Appliances.pdf

IOS URL filtering - CPU spike

Hi All,
whenever I setup URL filtering in 1841 router with policy-map type http and zone-pair command, I experience 100% CPU spike. is there any workaround?
thanks for any suggestion
Alex

Deep packet inspection for URL filtering is pretty much CPU intensive, I am afraid that without HW upgrade, there is nothing you can do about that.
Do you monitor CPU utilization with correlation to traffic load on device?
Best Regards
Please rate all helpful posts and close solved questions

Url filtering Route policy Firewall ?

Hello,
I'd like to know if it's possible to make a route policy (based on an identity matched by url white list) that redirect http trafic to a firewall (Juniper SSG550M).
The objectif is to separate traffic depending on url request as professionnal and non professionnal traffic, but Juniper can't be used as Upstream Proxy because it can't be use as a proxy. So, is it possible to create 2 "Direct connection" routing policies and specify 2 différents gateway ?
Or, if you have any other idea to separate traffic depending on url, I take it !
Regards,
Romain.

Hi Stella
AFAIK you can do URL filtering provided that you have a websense server installed at your site.
do refer this link for more info on the same..
http://www.cisco.com/en/US/partner/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a008008d1f7.html
regds

Cisco CSS as non-HTTPS SSL-traffic terminator

Hi!
Does anybody know is it real to use Cisco CSS as SSL-traffic terminator. I need to terminate non-HTTPS SSL-traffic on this device (i.e. SSL-encrypted sessions of any particular TCP-based application-layer protocol, not https)? If not, is there any CISCO device capable of doing such a job?
Regards, Amir

Hi!
Thank you very much for your reply.
I know about the S model - as per my post - but unfortunately I have realized after making the purchase.
Can you please help me with the following issue: my unit is not able to boot from FTP, even if I follow up the CISCO official documentation for that version (I issue all the commands as in the manual). More than that, if I setup the Primary Boot Configuration and then I want to check it up there is nothing in that field. The Secondary Boot Configuration keeps its settings and after the Primary failure it will try the Network Booting but with Failed status - returning me to the OffDM.
I mention that I am using the OffDM because the unit I bought has no Flash Card.
Also I am not sure how can I have a "network mounted filesystem" and in the meantime to use the FTP protocol; setting up a NFS server wont provide me with Windows style absolute path like k:/.... as per CISCO official guide. Is that a plain-ftp generically called as Network File System??? "First, create these subdirectories on the FTP server, then copy the files from the boot image to the subdirectories"
Is this linked with the fact that I am using a Linux box for my FTP Server? Can you please help me to understand what the following line from CISCO official guide means "A network boot is not supported on UNIX workstations"
Thank you!

URL Filtering w/ PIX 506

A customer called me to ask about URL filtering. He bought a 506 a little over a year ago. I haven't been on site to see exactly what IOS he has, but he wants to know if he can filter certain web sites from certain PCs. Of course the answer is yes, but I need to know more about the capabilities of the 506 URL filtering capabilities. Can I create a "White list" for certain PCs in an address range and allow full access to other PCs?
The real problem is on 3 PCs that midnight shift users like to use for porn surfing!
If the 506 can't do the filtering, then I may just add a local piece of software on the 3 problem PCs.
Any advice on the 506 capabilities would be appreciated.

hi
You can use websense in addition to PIX F/W to filter the traffic based on the URL,which is most widely deployed,but again u need to decide the cost factor involved in doing so.
regds

Schedule web url filtering in isa550

Hello,
This is my first experience using isa550 security appliance. i would like to schedule the web url filters: in example accept or deny some websites or url categories on certains hours, or days.
i see that the schedules can be applied on firewall rules, but i can't see how to apply theses schedules on web url filtering. when i link the web url policy to zones i don't see anything about shedules .
can you help please ?

I can confirm what you are seeing. There are schedules on the Application Control, for example, but not the web filter. One possible consideration with this is though you may want to allow some websites during certain times (Facebook over lunch hours for example) there would probably be blocked websites you would want to allow ever (child porn for example) ever. Since only one policy can be applied per Zone, until multiple policies can be applied to a Zone, you probably wouldn't want to turn off ALL web filtering for a Zone ever.
I'd recommend trying to leverage Application Control instead. You can apply multiple policies to a Zone so you could create a policy that includes everything that is blocked always and another that has content you'll allow during a schedule. The apply both policies to the same Zone and ensure your schedule policy is above your always block policy so that if there's ever a conflict the schedule policy would apply first and allow the traffic during allowed times. That's unless your internal security policies dictate otherwise.
Sent from Cisco Technical Support iPhone App

Is it recommended to scan SSL traffic

Depends on your company policy and provision of services
If you are in a highly regulated industry where web use is pinned down to work use only then yes you should be.
If you allow different devices on your network that arent managed it can be an issue deploying the intermediate certs needed
In more liberal working environments it can create staff "privacy" issues if you are intercepting their banking transactions, facebook posts and amazon purchases

We are using McAfee web filtering devices, where I have the option of scanning SSL traffic, I know and understand the SSL technology but still have a question in my mind, so it is better to get some suggestions.
Any suggestions will be highly appreciated.
This topic first appeared in the Spiceworks Community

Open Directory: After enabling of SSL encryption the Open Directory server is not reachable anymore! What's wrong?

After enabling of SSL encrypton on LDAP I can't connect anymore to the LDAB. I think the Lions Server supports now the SSL encrypton for Open Directory.

.....

Web Filtering / URL Filtering

Dear All,
I am looking forward to buy the cisco ASA Firewall with the below mentioned part number.
ASA5525-SSD120-K9 kindly please let me know whether it supports WEB Filtering / URL Filtering.
or do i need to go for any other model or license.
Awaiting your quick responses as it is very urgent.
Responses are highly appreciated..

That's the hardware
You also need a software subscription for the URL/web stuff/IPS
Near the bottom of this page: http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/data_sheet_c78-701659.html
there is a chart with the options and part numbers.

URL filtering ACE after description of SSL traffic

Similar Messages

Maybe you are looking for