This chapter describes how to use filtering services to provide greater control over traffic passing through the ASA and includes the following sections:
You can use web traffic filtering in two distinct ways:
Instead of blocking access altogether, you can remove specific undesirable objects from web traffic, such as ActiveX objects or Java applets, that may pose a security threat in certain situations.
You can use web traffic filtering to direct specific traffic to an external filtering server, such an Secure Computing SmartFilter (formerly N2H2) or the Websense filtering server. You can enable long URL, HTTPS, and FTP filtering using either Websense or Secure Computing SmartFilter for web traffic filtering. Filtering servers can block traffic to specific sites or types of sites, as specified by the security policy.
Note URL caching will only work if the version of the URL server software from the URL server vendor supports it.
Because web traffic filtering is CPU-intensive, using an external filtering server ensures that the throughput of other traffic is not affected. However, depending on the speed of your network and the capacity of your web traffic filtering server, the time required for the initial connection may be noticeably slower when filtering traffic with an external filtering server.
This section includes the following topics:
ActiveX objects may pose security risks because they can contain code intended to attack hosts and servers on a protected network. You can disable ActiveX objects with ActiveX filtering.
ActiveX controls, formerly known as OLE or OCX controls, are components that you can insert in a web page or another application. These controls include custom forms, calendars, or any of the extensive third-party forms for gathering or displaying information. As a technology, ActiveX creates many potential problems for network clients including causing workstations to fail, introducing network security problems, or being used to attack servers.
The filter activex command blocks the HTML object commands by commenting them out within the HTML web page. ActiveX filtering of HTML files is performed by selectively replacing the <APPLET> and </APPLET>, and <OBJECT CLASSID> and </OBJECT> tags with comments. Filtering of nested tags is supported by converting top-level tags to comments.
If the <object> or </object> HTML tags split across network packets or if the code in the tags is longer than the number of bytes in the MTU, the ASA cannot block the tag.
ActiveX blocking does not occur when users access an IP address referenced by the alias command or for clientless SSL VPN traffic.
The following table shows the licensing requirements for this feature:
|
|
---|---|
This section includes the guidelines and limitations for this feature.
Supported in single and multiple context mode.
To remove ActiveX objects in HTTP traffic that is passing through the ASA, enter the following command:
You can set either address to 0.0.0.0 (or in shortened form, 0) to specify all hosts. You can use 0.0.0.0 for either mask (or in shortened form, 0) to specify all masks. This command specifies that the ActiveX object blocking applies to HTTP traffic on port 80 from any local host and for connections to any foreign host.
The following example shows how to configure ActiveX filtering to block all outbound connections:
The following example shows how to remove ActiveX filtering:
Table 4-1 lists the release history for ActiveX Filtering. ASDM is backwards-compatible with multiple platform releases, so the specific ASDM release in which support was added is not listed.
|
|
|
---|---|---|
Filters specific undesirable objects from HTTP traffic, such as ActiveX objects, which may pose a security threat in certain situations. |
This section includes the following topics:
Java applets may pose security risks because they can contain code intended to attack hosts and servers on a protected network. You can remove Java applets with the filter java command.
Note Use the filter activex command to remove Java applets that are embedded in <object> tags.
The filter java command filters out Java applets that return to the ASA from an outbound connection. You still receive the HTML page, but the web page source for the applet is commented out so that the applet cannot execute. The filter java command does not filter clientless SSL VPN traffic.
The following table shows the licensing requirements for Java applet filtering:
|
|
---|---|
This section includes the guidelines and limitations for this feature.
Supported in single and multiple context mode.
To apply filtering to remove Java applets from HTTP traffic passing through the ASA, enter the following command:
The following example specifies that Java applets are blocked on all outbound connections:
This command specifies that the Java applet blocking applies to web traffic on port 80 from any local host and for connections to any foreign host.
The following example blocks downloading of Java applets to a host on a protected network:
This command prevents host 192.168.3.3 from downloading Java applets.
The following example removes the configuration for downloading Java applets to a host on a protected network:
This command allows host 192.168.3.3 to download Java applets.
Table 4-1 lists the release history for Java applet filtering. ASDM is backwards-compatible with multiple platform releases, so the specific ASDM release in which support was added is not listed.
|
|
|
---|---|---|
Filters specific undesirable objects from HTTP traffic, such as Java applets, which may pose a security threat in certain situations. |
This section describes how to filter URLs and FTP requests with an external server and includes the following topics:
You can apply filtering to connection requests originating from a more secure network to a less secure network. Although you can use ACLs to prevent outbound access to specific content servers, managing usage this way is difficult because of the size and dynamic nature of the Internet. You can simplify configuration and improve ASA performance by using a separate server running one of the following Internet filtering products:
In long URLs, the URL in the Referer field might contain a “host:” text string, which could cause the HTTP GET header to be incorrectly parsed as containing the HTTP Host parameter. The ASA, however, correctly parses the Referer field even when it contains a “host:” text string and forwards the header to the McAfee SmartFilter server with the correct Referer URL.
Note URL caching will only work if the version of the URL server software from the URL server vendor supports it.
Although ASA performance is less affected when using an external server, you might notice longer access times to websites or FTP servers when the filtering server is remote from the ASA.
When filtering is enabled and a request for content is directed through the ASA, the request is sent to the content server and to the filtering server at the same time. If the filtering server allows the connection, the ASA forwards the response from the content server to the originating client. If the filtering server denies the connection, the ASA drops the response and sends a message or return code indicating that the connection was not successful.
If user authentication is enabled on the ASA, then the ASA also sends the username to the filtering server. The filtering server can use user-specific filtering settings or provide enhanced reporting about usage.
The following table shows the licensing requirements for URL filtering:
|
|
---|---|
This section includes the guidelines and limitations for this feature.
Supported in single and multiple context mode.
You can identify up to four filtering servers per context. The ASA uses the servers in order until a server responds. In single mode, a maximum of 16 of the same type of filtering servers are allowed. You can only configure a single type of server (Websense or Secure Computing SmartFilter) in your configuration.
Note You must add the filtering server before you can configure filtering for HTTP or HTTPS.
Step 1 In the ASDM main window, choose Configuration > Firewall > URL Filtering Servers.
Step 2 In the URL Filtering Server Type area, click one of the following options:
Step 3 If you chose the second option, enter the Secure Computing SmartFilter port number if it is different than the default port number, which is 4005.
Step 4 In the URL Filtering Servers area, click Add.
If you chose the Websense option, the Add Parameters for Websense URL Filtering dialog box appears.
The new Websense URL filtering server properties appear in the URL Filtering Servers pane. To change these properties, click Edit. To add more Websense URL filtering servers after you have added the first Websense URL filtering server, click Add or Insert. To remove a Websense URL filtering server, click Delete.
If you chose the Secure Computing SmartFilter URL Filtering option, the Add Parameters for Secure Computing SmartFilter URL Filtering dialog box appears.
The new Secure Computing SmartFilter URL filtering server properties appear in the URL Filtering Servers pane. To change these properties, click Edit. To add more Secure Computing SmartFilter URL filtering servers after you have defined the first Secure Computing SmartFilter URL filtering server, click Add or Insert. To remove a Secure Computing SmartFilter URL filtering server, click Delete.
After you have accessed a website, the filtering server can allow the ASA to cache the server address for a certain period of time, as long as each website hosted at the address is in a category that is permitted at all times. When you access the server again, or if another user accesses the server, the ASA does not need to consult the filtering server again to obtain the server address.
Note Requests for cached IP addresses are not passed to the filtering server and are not logged. As a result, this activity does not appear in any reports.
This section describes how to configure additional URL filtering settings and includes the following topics:
When you issue a request to connect to a content server, the ASA sends the request to the content server and to the filtering server at the same time. If the filtering server does not respond before the content server, the server response is dropped. This behavior delays the web server response for the web client, because the web client must reissue the request.
By enabling the HTTP response buffer, replies from web content servers are buffered, and the responses are forwarded to the requesting client if the filtering server allows the connection. This behavior prevents the delay that might otherwise occur.
Step 1 In the URL Filtering Servers pane, click Advanced to display the Advanced URL Filtering dialog box.
Step 2 In the URL Buffer Size area, check the Enable buffering check box.
Step 3 Enter the number of 1550-byte buffers. Valid values range from 1 to 128.
Step 4 Click OK to close this dialog box.
After you access a website, the filtering server can allow the ASA to cache the server address for a certain period of time, as long as each website hosted at the address is in a category that is permitted at all times. When you access the server again, or if another user accesses the server, the ASA does not need to consult the filtering server again.
Note Requests for cached IP addresses are not passed to the filtering server and are not logged. As a result, this activity does not appear in any reports. You can accumulate Websense run logs before using the url-cache command.
Step 1 In the URL Filtering Servers pane, click Advanced to display the Advanced URL Filtering dialog box.
Step 2 In the URL Cache Size area, check the Enable caching based on check box to enable caching according to the specified criteria.
Step 3 Click one of the following radio buttons:
Step 4 Enter the cache size within the range from 1 to 128 (KB).
Step 5 Click OK to close this dialog box.
This section describes how to configure HTTP filtering with an external filtering server and includes the following topics:
You must identify and enable the URL filtering server before enabling HTTP filtering. When the filtering server approves an HTTP connection request, the ASA allows the reply from the web server to reach the originating client. If the filtering server denies the request, the ASA redirects you to a block page, indicating that access was denied.
To enable HTTP filtering, enter the following command:
By default, the ASA considers an HTTP URL to be a long URL if it is greater than 1159 characters. You can increase the maximum length allowed.
Step 1 In the URL Filtering Servers pane, click Advanced to display the Advanced URL Filtering dialog box.
Step 2 In the Long URL Support area, check the Use Long URL check box to enable long URLs for filtering servers.
Step 3 Enter the maximum URL length allowed, up to a maximum of 4 KB.
Step 4 Enter the memory allocated for long URLs in KB.
Step 5 Click OK to close this dialog box.
By default, if a URL exceeds the maximum permitted size, then it is dropped. To avoid this occurrence, truncate a long URL by entering the following command:
To exempt traffic from filtering, enter following command:
You must identify and enable the URL filtering server before enabling HTTPS filtering.
Note Websense and Secure Computing Smartfilter currently support HTTPS; older versions of the Secure Computing SmartFilter (formerly N2H2) do not support HTTPS filtering.
Because HTTPS content is encrypted, the ASA sends the URL lookup without directory and filename information. When the filtering server approves an HTTPS connection request, the ASA allows the completion of SSL connection negotiation and allows the reply from the web server to reach the originating client. If the filtering server denies the request, the ASA prevents the completion of SSL connection negotiation. The browser displays an error message, such as “The Page or the content cannot be displayed.”
Note The ASA does not provide an authentication prompt for HTTPS, so you must authenticate with the ASA using HTTP or FTP before accessing HTTPS servers.
To enable HTTPS filtering, enter the following command:
You must identify and enable the URL filtering server before enabling FTP filtering.
Note Websense and Secure Computing Smartfilter currently support FTP; older versions of Secure Computing SmartFilter (formerly known as N2H2) did not support FTP filtering.
When the filtering server approves an FTP connection request, the ASA allows the successful FTP return code to reach the originating client. For example, a successful return code is “250: CWD command successful.” If the filtering server denies the request, the FTP return code is changed to show that the connection was denied. For example, the ASA changes code 250 to “550 Requested file is prohibited by URL filtering policy.”
To enable FTP filtering, enter the following command:
Before you can add an HTTP, HTTPS, or FTP filter rule, you must enable a URL filtering server. To enable a URL filtering server, choose Configuration > Firewall > URL Filtering Servers.
To configure filtering rules, perform the following steps:
Step 1 From the ASDM main window, choose Configuration > Firewall > Filter Rules.
Step 2 In the toolbar, click Add to display the types of filter rules that are available to add from the following list:
Step 3 If you chose Add Filter ActiveX Rule, specify the following settings:
– Enter any to indicate any source address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Source dialog box. Choose a host or address from the drop-down list.
– Enter any to indicate any destination address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Destination dialog box. Choose a host or address from the drop-down list.
– tcp/ port —The port number can range from 1 to 65535. Additionally, you can use the following modifiers with the TCP service:
!=—Not equal to. For example, !=tcp/443.
<—Less than. For example, <tcp/2000.
>—Greater than. For example, >tcp/2000.
- —Range. For example, tcp/2000-3000.
– Enter a well-known service name, such as HTTP or FTP.
– Click the ellipses to display the Browse Service dialog box. Choose a service from the drop-down list.
Step 4 If you chose Add Filter Java Rule, specify the following settings:
– Enter any to indicate any source address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Source dialog box. Choose a host or address from the drop-down list.
– Enter any to indicate any destination address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Destination dialog box. Choose a host or address from the drop-down list.
– tcp/ port —The port number can be from 1 to 65535. Additionally, you can use the following modifiers with the TCP service:
!=—Not equal to. For example, !=tcp/443.
<—Less than. For example, <tcp/2000.
>—Greater than. For example, >tcp/2000.
- —Range. For example, tcp/2000-3000.
– Enter a well-known service name, such as HTTP or FTP.
– Click the ellipses to display the Browse Service dialog box. Choose a service from the drop-down list.
Step 5 If you chose Add Filter HTTP Rule, specify the following settings:
– Enter any to indicate any source address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Source dialog box. Choose a host or address from the drop-down list.
– Enter any to indicate any destination address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Destination dialog box. Choose a host or address from the drop-down list.
– tcp/ port —The port number can range from 1 to 65535. Additionally, you can use the following modifiers with the TCP service:
!=—Not equal to. For example, !=tcp/443.
<—Less than. For example, <tcp/2000.
>—Greater than. For example, >tcp/2000.
- —Range. For example, tcp/2000-3000.
– Enter a well-known service name, such as HTTP or FTP.
– Click the ellipses to display the Browse Service dialog box. Choose a service from the drop-down list.
Step 6 If you chose Add Filter HTTPS Rule, specify the following settings:
– Enter any to indicate any source address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Source dialog box. Choose a host or address from the drop-down list.
– Enter any to indicate any destination address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Destination dialog box. Choose a host or address from the drop-down list.
– tcp/ port —The port number can range from 1 to 65535. Additionally, you can use the following modifiers with the TCP service:
!=—Not equal to. For example, !=tcp/443
<—Less than. For example, <tcp/2000.
>—Greater than. For example, >tcp/2000.
- —Range. For example, tcp/2000-3000.
– Enter a well-known service name, such as HTTP or FTP.
– Click the ellipses to display the Browse Service dialog box. Choose a service from the drop-down list.
Step 7 If you chose Add Filter FTP Rule, specify the following settings:
– Enter any to indicate any source address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Source dialog box. Choose a host or address from the drop-down list.
– Enter any to indicate any destination address.
– Enter an IP address and optional network mask. You can express the netmask in CIDR or dotted decimal notation. For example, you can enter 10.1.1.0/24 or 10.1.1.0/255.255.255.0.
– Click the ellipses to display the Browse Destination dialog box. Choose a host or address from the drop-down list.
– tcp/ port —The port number can range from 1 to 65535. Additionally, you can use the following modifiers with the TCP service:
!=—Not equal to. For example, !=tcp/443
<—Less than. For example, <tcp/2000.
>—Greater than. For example, >tcp/2000.
- —Range. For example, tcp/2000-3000.
– Enter a well-known service name, such as http or ftp.
– Click the ellipses to display the Browse Service dialog box. Choose a service from the drop-down list.
Step 8 To modify a filtering rule, select it and click Edit to display the Edit Filter Rule dialog box for the specified filtering rule.
Step 9 Make the required changes, then click OK to close this dialog box.
Step 10 Click Apply to save your changes.
To find a specific rule if your rule table includes a lot of entries, you can apply a filter to the rule table to show only the rules specified by the filter. To filter the rule table, perform the following steps:
Step 1 Click Find on the toolbar to display the Filter toolbar.
Step 2 Choose the type of filter from the Filter drop-down list:
Step 3 For Source, Destination, Source or Destination, and Service filters, perform the following steps:
a. Enter the string to match using one of the following methods:
– Type the source, destination, or service name in the adjacent field.
– Click the ellipses to open a Browse dialog box from which you can choose existing services, IP addresses, or host names.
b. Choose the match criteria from the drop-down list. Choose is for exact string matches or contains for partial string matches.
Step 4 For Rule Type filters, choose the rule type from the list.
Step 5 For Query filters, click Define Query. To define queries, see the “(ASDM) Defining Queries” section.
Step 6 To apply the filter to the rule table, click Filter.
Step 7 To remove the filter from the rule table and display all rule entries, click Clear.
Step 8 To show the packet trace for the selected rule, click Packet Trace.
Step 9 To show and hide the selected rule diagram, click Diagram.
Step 10 To remove a filter rule and place it elsewhere, click Cut.
Step 11 To copy a filter rule, click Copy. Then to move the copied filter rule elsewhere, click Paste.
Step 12 To delete a selected filter rule, click Delete.
To define queries, perform the following steps:
Step 1 Enter the IP address or hostname of the source. Choose is for an exact match or choose contains for a partial match. Click the ellipses to display the Browse Source dialog box. You can specify a network mask using CIDR notation (address/bit-count). You can specify multiple addresses by separating them with commas.
Step 2 Enter the IP address or hostname of the destination. Choose is for an exact match or choose contains for a partial match. Click the ellipses to display the Browse Destination dialog box. You can specify a network mask using CIDR notation (address/bit-count). You can specify multiple addresses by separating them with commas.
Step 3 Enter the IP address or hostname of the source or destination. Choose is for an exact match or choose contains for a partial match. Click the ellipses to display the Browse Source dialog box. You can specify a network mask using CIDR notation (address/bit-count). You can specify multiple addresses by separating them with commas.
Step 4 Enter the protocol, port, or name of a service. Choose is for an exact match or choose contains for a partial match. Click the ellipses to display the Browse Service dialog box. You can specify a network mask using CIDR notation (address/bit-count). You can specify multiple addresses by separating them with commas.
Step 5 Choose the rule type from the drop-down list.
Step 6 Click OK to close this dialog box.
After you click OK, the filter is immediately applied to the rule table. To remove the filter, click Clear.
To monitor filtering statistics, enter one of the following commands:
The following is sample output from the show url-server command:
The following is sample output from the show url-server statistics command:
The following is sample output from the show url-block command:
The following is sample output from the show url-block block statistics command:
The following is sample output from the show url-cache stats command:
The following is sample output from the show perfmon command:
The following is sample output from the show filter command:
Table 4-5 lists the release history for URL filtering. ASDM is backwards-compatible with multiple platform releases, so the specific ASDM release in which support was added is not listed.
|
|
|
---|---|---|
Filters URLs based on an established set of filtering criteria. |