Cisco Systems Filtering URLs and FTP Requests with an External Server

29-2
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter29 Configuring Filtering Services
Filtering URLs and FTP Requests with an External Server
Filtering URLs and FTP Requests with an External Server
This section describes how to filter URLs and FTP requests with an external server and includes the
following topics:
•Information About URL Filtering, page29-2
•Licensing Requirements for URL Filtering, page29-3
•Guidelines and Limitations for URL Filtering, page29-3
•Identifying the Filtering Server, page29-3
•Configuring Additional URL Filtering Settings, page29-4
•Feature History for URL Filtering, page29-12
Information About URL Filtering
You can apply filtering to connection requests originating from a more secure network to a less secure
network. Although you can use ACLs to prevent outbound access to specific content servers, managing
usage this way is difficult because of the size and dynamic nature of the Internet. You can simplify
configuration and improve ASA performance by using a separate server running one of the following
Internet filtering products:
•Websense Enterprise for filtering HTTP, HTTPS, and FTP.
•McAfee SmartFilter (formerly N2H2) for filtering HTTP, HTTPS, FTP, and long URL filtering.
In long URLs, the URL in the Referer field might contain a “host:” text string, which could cause
the HTTP GET header to be incorrectly parsed as containing the HTTP Host parameter. The ASA,
however, correctly parses the Referer field even when it contains a “host:” text string and forwards
the header to the McAfee SmartFilter server with the correct Referer URL.
Note URL caching will only work if the version of the URL server software from the URL server vendor
supports it.
Although ASA performance is less affected when using an external server, you might notice longer
access times to websites or FTP servers when the filtering server is remote from the ASA.
When filtering is enabled and a request for content is directed through the ASA, the request is sent to
the content server and to the filtering server at the same time. If the filtering server allows the connection,
the ASA forwards the response from the content server to the originating client. If the filtering server
denies the connection, the ASA drops the response and sends a message or return code indicating that
the connection was not successful.
If user authentication is enabled on the ASA, then the ASA also sends the username to the filtering
server. The filtering server can use user-specific filtering settings or provide enhanced reporting about
usage.