Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 147)

3-35

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Filtering Outbound Connections

To enable HTTPS filtering, use the following command:

filter https dest_port |except localIP local_mask foreign_IP foreign_mask [allow]

To enable FTP filtering, use the following command:

filter ftp dest_port |except localIP local_mask foreign_IP foreign_mask [allow]

[interact-block]

The filter ftp command lets you identify the FTP traffic to be filtered by a Websense server. FTP filtering

is not supported on N2H2 servers.

After enabling this feature, when a user issues an FTP GET request to a server, the PIX Firewall sends

the request to the FTP server and to the Websense server at the same time. If the Websense server permits

the connection, the firewall allows the successful FTP return code to reach the user unchanged. For

example, a successful return code is “250: CWD command successful.”

If the Websense server denies the connection, the PIX Firewall alters the FTP return code to show that

the connection was denied. For example, the PIX

Firewall would change code 250 to “code 550:

Directory not found.” Websense only filters FTP GET commands and not PUT commands).

Use the interactive-block option to prevent interactive FTP sessions that do not provide the entire

directory path. An interactive FTP client allows the user to change directories without typing the entire

path. For example, the user might enter cd ./files instead of cd /public/files.

You must identify and enable the URL filtering server before using these commands. If all URL filtering

servers are removed, any associated filtering commands are also removed.

Configuring Filtering Policy

Use the filter url command to configure the policy for filtering URLs. The syntax of the command for

filtering URLs is as follows.

filter url port[-port] local_ip local_mask foreign_ip foreign_mask] [allow] [proxy-block]

Replace port with the port number on which to filter HTTP traffic. To identify a range of port numbers,

enter the beginning and end of the range separated by a hyphen.

To identify specific HTTP traffic for filtering, replace local_ip and local_mask with the IP address and

subnet mask of a user or subnetwork making requests. Replace foreign_ip and foreign_mask with the IP

address and subnet mask of a server or subnetwork responding to requests.

With filtering enabled, the PIX Firewall stops outbound HTTP traffic until a filtering server permits the

connection. If the primary filtering server does not respond, the PIX

Firewall directs the filtering request

to the secondary filtering server. The allow option causes the PIX

Firewall to forward HTTP traffic

without filtering when the primary filtering server is unavailable.

Use the proxy-block command to drop all requests to proxy servers.

If you want to make exceptions to the general filtering policy, use the following command:

filter url except local_ip local_mask foreign_ip foreign_mask]

Replace local_ip and local_mask with the IP address and subnet mask of a user or subnetwork that you

want to exempt from filtering restrictions. Replace foreign_ip and foreign_mask with the IP address and

subnet mask of a server or subnetwork that you want to exempt from filtering restrictions.

1 2 ... 142 143 144 145 146 147 148 149 150 151 152 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 147

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525