Guest

Cisco IOS Content Filtering

Cisco IOS Content Filtering

  • Viewing Options

  • PDF (207.1 KB)
  • Feedback
Q. What is Cisco IOS ® Content Filtering?
A. Cisco IOS Content Filtering protects your WAN links and critical network infrastructure from web-based threats. It is a subscription-based service that allows network administrators to create router policies that limit Internet access based on Website categories (such as violence or pornography) or security ratings for sites that are known to dispense malicious content.
Q. What are the benefits of using Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering helps organizations improve employee productivity and protect users from malware, adware, spyware, and phishing.
Q. Who is best suited to take advantage of Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is ideal for retail locations, small and medium-sized businesses, enterprise branch offices, and schools.

Solution Details

Q. What is the difference between the URL Filtering feature in Cisco IOS Software, and the new Cisco IOS Content Filtering?
A. Cisco IOS URL Filtering feature supports only static black and white lists, and off-box support for Websense and Smartfilter. The subscription-based Cisco IOS Content Filtering service adds security rating and category blocking to static black and white lists, and keyword blocking starting from Cisco IOS Software Release 12.4(15)XZ.
Q. Can Cisco IOS Content Filtering be configured with other security features?
A. Yes. All other security features, such as VPN, firewall, and intrusion prevention, can be configured with Cisco IOS Content Filtering.
Q. Why do I need content filtering if I already have a firewall?
A. A firewall is designed to allow or block Internet traffic. Cisco IOS Content Filtering provides protection from malicious Websites and enables organizations to address compliance requirements and enforce a consistent Web security policy.
Q. Can Cisco IOS Firewall and Cisco IOS Content Filtering be turned on together?
A. Yes. Cisco IOS Firewall and Cisco IOS Content Filtering can be turned on together on the same interface, as long as the new subscription-based Cisco IOS Content Filtering is used with Zone-Based Cisco IOS Firewall introduced in 12.4(6)T (not context-based access control [CBAC]).
Q. What is the role of Trend Micro in Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering uses Trend Micro's Rating Server and research conducted by Trend Micro's TrendLabs™. Trend Micro's URL database contains millions of URLs in more than 70 categories, including productivity and security categories. Trend Micro's TrendLabs™ conducts research on millions of Websites and updates the database regularly
Q. What are categories?
A. Most types of Websites that are frequently surfed are put into categories (such as gaming, pornography, weapons, or stock trading). Trend Micro's database contains URLs in each of these categories. Cisco IOS Content Filtering has more than 70 categories to select from.
Q. List the 70 Productivity Categories supported by Trend Micro?
A. Here's the list of all the 70 Productivity categories:

ABORTION

Abortion related website

ACTIVIST-GROUPS

Activist groups related website

ADULT-MATURE-CONTENT

Adults/Mature content website

ALCOHOL-TOBACCO

Alcohol and tobacco related website

ALTERNATIVE-JOURNALS

Alternative Journals related website

ARTS

Arts related website

AUCTIONS

Auction related website

BROKERAGE-TRADING

Brokerage or trading related website

BUSINESS-ECONOMY

Business or Economy related website

CHAT-INSTANT-MESSAGING

Chat or Instant Messaging related website

COMPUTERS-INTERNET

Computers or internet related website

COOKIES

Cookies related website

CULT-OCCULT

Cult or Occult related website

CULTURAL-INSTITUTIONS

Cultural or Institutions related website

EDUCATION

Education related website

EMAIL

Email related website

ENTERTAINMEMT

Entertainment related website

FINANCIAL-SERVICES

Financial services related website

FOR-KIDS

For kids website

GAMBLING

Gambling related website

GAMES

Games related website

GAY-LESBIAN

Gay or Lesbian related website

GOVERNMENT-LEGAL

Government legal related website

HEALTH

Health related website

HUMOR-JOKES

Humor or jokes related website

ILLEGAL-DRUGS

Illegal or drugs related website

ILLEGAL-QUESTIONABLE

Illegal or questionable related website

INFRASTRUCTURE

Infrastructure related website

INTERNET-RADIO-AND-TV

Internet Radio/TV website

INTERNET-TELEPHONY

Internet Telephony related website

INTIMATE-APPAREL-SWIMSUIT

Intimate or apparel or swimsuit related website

JOB-SEARCH-CAREER

Job searching or career related website

JOKE-PROGRAMS

Joke programs related website

MARIJUANA

Marijuana related website

MILITARY

Military related website

NEWS-MEDIA

News or mdia related website

NEWSGROUPS

Newsgroups website

NUDITY

Nudity related website

PAY-TO-SURF

Pay to surf website

PEER-TO-PEER

Peer to Peer website

PERSONAL-NETWORK-STORAGE

Personal network storage related website

PERSONAL-WEBSITES

Personal Websites

PERSONALS-DATING

Personals or dating related website

PHOTO-SEARCHES

Photo searches related website

POLITICAL

Political related website

PORNOGRAPHY

Pornography related website

PROXY-AVOIDANCE

Proxy avoidance website

REAL-ESTATE

Real estate related website

RECREATION-HOBBIES

Recreation/Hobbies related website

REFERENCE

Reference website

RELIGION

Religion related website

REMOTE-ACCESS-PROGRAMS

Remote access programs website

RESTAURANTS-DINING-FOOD

Restaurants or dining or food related website

RINGTONES-MOBLIE-PHONE-DOWNLOADS

Ringtones Moblie phone Downloads website

SEARCH-ENGINES-PORTALS

Search engines or portals related website

SEX-EDUCATION

Sex education related website

SHOPPING

Shopping website

SOCIAL-NETWORKING

Social networking website

SOCIETY-LIFESTYLE

Society lifestyle website

SOFTWARE-DOWNLOADS

Software downloads website

SPAM

Spam related website

SPORT-HUNTING-AND-GUN-CLUBS

Sport hunting and gun clubs related website

SPORTS

Sports related website

STREAMING-MEDIA-MP3

Streaming media MP3 related website

TASTELESS

Tasteless related website

TRANSLATORS

Translators related website

TRAVEL

Travel related website

UNRATED

Unrated URLs

VEHICLES

Vehicles related website

VIOLENCE-HATE-RACISM

Violence or hate or racism related website

WEAPONS

Weapons related website

WEB-ADVERTISEMENTS

Web advertisements related website

WEB-COMMUNICATIONS

Web communications related website

WEB-HOSTING

Web hosting website

Q. What is a reputation security rating?
A. In this context, a security rating is a rating given by Trend Micro's TrendLabs to a URL based on a combination of a URL's past behavior and current exposure to malware, adware, phishing, spyware, and hacking.
Q. List all the Security categories supported by Trend Micro?
A. Here's the list of all the 10 security categories supported:

ADWARE

A software package download advertising material to a computer

DIALER

A computer program connects to Internet or another computer network

DISEASE-VECTOR

Disease vector

HACKING

Computer Hacking

PASSWORD-CRACKING-APPLICATIONS

Password cracking applications

PHISHING

A form of criminal activity using social engineering techniques

POTENTIALLY-MALICIOUS-SOFTWARE

Potentially malicious software

SPYWARE

Malicious website may install Spyware on reader's computer

UNBLEMISHED

Unblemished website

VIRUS-ACCOMPLICE

Virus accomplice

Q. Are Websense and SmartFilter still supported?
A. Yes. Cisco IOS Content Filtering still supports Websense and SmartFilter.
Q. How is Cisco IOS Content Filtering configured?
A. Cisco IOS Content Filtering can be configured using Cisco Configuration Professional 1.1 or a command-line interface. Please refer to the configuration guide at http://www.cisco.com/go/ioscontentfiltering for more details.
Q. What are my management options for Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering can be configured using Cisco Configuration Professional. CCP 1.1 can be downloaded at http://www.cisco.com/go/ciscocp.

Also, Cisco Security Manager 3.3 supports IOS Content Filtering.

Q. What platforms support Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is supported on the following platforms:

• Cisco 800 Series

• Cisco 1800 Series

• Cisco 1900 Series

• Cisco 2800 Series

• Cisco 2900 Series

• Cisco 3800 Series

• Cisco 3900 Series

Q. What feature sets support Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is supported on the Advanced IP Services image in the Cisco 800 series and Advanced Security image and higher on Cisco 1800, 2800, and 3800 series platforms.
Q. What is the performance impact?
A. Since the categories and their respective decisions (permit or deny) are cached, the router need not reference the database each time a web page is requested. Therefore there is minimal performance impact when pages are accessed for the first time and there is no impact for cached pages.
Q. Do I need additional memory to turn on Cisco IOS Content Filtering?
A. No. Standard memory that comes with the ISRs is sufficient.
Q. Do "ip inspect" commands work with Cisco IOS Content Filtering?
A. No. "ip inspect" commands do not work with Cisco IOS Content Filtering.

Licensing

Q. How is licensing handled?
A. Unlike many Content Filtering solutions, Cisco IOS Content Filtering does not require a per-user license. It is based on purchasing a 1 year subscription service associated with your router platform. A 30-day trial license is also available. SL-CNFIL-8xx-TRI, SL-CNFIL-1xxx-TRI, SL-CNFIL-2xxx-TRI, and SL-CNFIL-3xxx-TRI are the SKUs for the 30 day license.
Q. How do I order trial license and when does the trial period start? What do I do when my trial period expires?
A. You can order the trial license through the Cisco demo license website at http://www.cisco.com/go/license. At this website, please enter your router Serial number and router type. A 30 day trial license will get activated the day you enter your router credentials on the site. For IOS Content Filtering to work, you would have to download a certificate from http://www.cisco.com/en/US/products/ps5854/products_configuration_example09186a0080816c23.shtml and then configure IOS Content Filtering on the router.

Once the 30 day trial period is over, you can purchase a subscription service for IOS Content Filtering. Subscription service

Q. What happens if I misplace my activation code?
A. Please call Cisco TAC in case you misplace your activation code.
Q. What happens if my license expires before a renewal can be completed?
A. Once a license expires, you are provided with a 30-day grace period, during which you continue to receive all the benefits of active licenses. After the 30-day grace period, the product will cease to retrieve any updates and the Content filtering functionality will allow all URLs unfiltered, unless they are part of the static black and white lists, or blocked keywords.

Ordering

Q. What IOS images support Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is available in the Advanced IP Services image on the Cisco 800 series routers. For the rest of the ISRs, Advanced Security image or higher is needed. A 1 year license is required to enable the service. For the next-generation of Integrated Services Routers, the security package supports IOS Content Filtering.
Q. How do I purchase my IOS Content Filtering license?
A. Please work with your Cisco partner to purchase a software subscription license for IOS Content Filtering. You will receive a PAK (product activation key) when order is fulfilled. Then you can register it on the licensing portal http://www.cisco.com/go/license.

Once registered, the subscription period begins. Configure the router appropriately and start benefitting from the service. For more configuration details, please visit http://www.cisco.com/go/ioscontentfiltering.

Q. What are the SKUs for Cisco IOS Content Filtering?
A. The following SKUs are supported:

• SL-CNFIL-88x-1Y

• SL-CNFIL-87x-1Y

• SL-CNFIL-180X-1Y

• SL-CNFIL-181X-1Y

• SL-CNFIL-184-1Y

• SL-CNFIL-186-1Y

• SL-CNFIL-280-1Y

• SL-CNFIL-281-1Y

• SL-CNFIL-282-1Y

• SL-CNFIL-285-1Y

• SL-CNFIL-382-1Y

• SL-CNFIL-384-1Y

Q. Do I purchase the subscription service directly from Trend Micro?
A. No. The subscription service as well as renewals are purchased from Cisco.
Q. How do I renew my subscriptions?
A. You should purchase software subscription service license for Cisco IOS Content Filtering through your Cisco partner as you are nearing completion of the existing subscription. The router will send reminders to the console 30 days prior to the subscription expiration.

The renewal process is much like a new license purchase process: you will receive a PAK when the renewal order is fulfilled. When you register it, the product will be renewed seamlessly. You do not need a new activation code to renew the subscription.

Technical Support

Q. Is the Cisco IOS Content Filtering service included in Cisco SMARTnet ® support?
A. No. The Cisco IOS Content Filtering subscription service is separate from Cisco SMARTnet. However, Cisco SMARTnet is also required in conjunction with a Cisco IOS Content Filtering subscription. Cisco SMARTnet provides you with access to the Cisco Technical Assistance Center (TAC) and Cisco IOS software updates.
Q. I have a subscription service from Trend Micro for my Cisco router. Do I need to go to them for support?
A. No, call Cisco TAC for all support questions.
Q. How do I rehost the Cisco IOS Content Filtering subscription?
A. Please call Cisco TAC for rehosting subscription service from one router to another.
Q. Where can I learn more about Cisco SMARTnet Services?

General Information

Q. Where is the Trend Micro URL database located?
A. Trend Micro's databases are strategically located to support users around the world with built-in redundancy for high availability.
Q. How does Cisco IOS Content Filtering differ from the Content Security and Control module for the ASA platform?
A. Cisco IOS Content Filtering is a subscription based service for Cisco ISRs that provide protection from malicious websites as well as improve employee productivity using URL filtering techniques. The Cisco Content Security and Control (CSC-SSM) module is an expansion card for the Cisco ASA 5500 Series of security appliances that scans Web, e-mail, and ftp traffic to stop content-based threats, including phishing, spyware, spam, and viruses. The CSC-SSM also controls unwanted mail and Web content. Both products use technology from Trend Micro.
Q. How can I learn more about Cisco IOS Content Filtering?
A. Please visit http://www.cisco.com/go/ioscontentfiltering for more information or contact your local Cisco sales team.

Cisco Recommendations for IOS Content Filtering

Q. What is the recommended order of configuration for Content Filtering?
A. Cisco recommends the following order to configure IOS Content Filtering:

1. Black Lists

2. White Lists

3. Keywords to block

4. Security Rating Categories

5. Prodcutivity Categories

Q. What is Cisco's recommendation on Security Rating Categories?
A. Cisco recommends turning on all the Security Rating Categories except for the UNBLEMISHED category.