Caching Server Addresses

After a user accesses a site, the filtering server can allow the security appliance to cache the server address for a certain amount of time, as long as every site hosted at the address is in a category that is permitted at all times. Then, when the user accesses the server again, or if another user accesses the server, the security appliance does not need to consult the filtering server again.

Note Requests for cached IP addresses are not passed to the filtering server and are not logged. As a result, this activity does not appear in any reports. You can accumulate Websense run logs before using the url-cache command.

Use the url-cache command if needed to improve throughput, as follows:

hostname(config)# url-cache dst | src_dst size

Replace size with a value for the cache size within the range 1 to 128 (KB).

Use the dst keyword to cache entries based on the URL destination address. Select this mode if all users share the same URL filtering policy on the Websense server.

Use the src_dst keyword to cache entries based on both the source address initiating the URL request as well as the URL destination address. Select this mode if users do not share the same URL filtering policy on the Websense server.

Filtering HTTP URLs

This section describes how to configure HTTP filtering with an external filtering server. This section includes the following topics:

• Configuring HTTP Filtering, page 20-7

• Enabling Filtering of Long HTTP URLs, page 20-7

• Truncating Long HTTP URLs, page 20-7

• Exempting Traffic from Filtering, page 20-8

Configuring HTTP Filtering

You must identify and enable the URL filtering server before enabling HTTP filtering.

When the filtering server approves an HTTP connection request, the security appliance allows the reply from the web server to reach the originating client. If the filtering server denies the request, the security appliance redirects the user to a block page, indicating that access was denied.

To enable HTTP filtering, enter the following command:

hostname(config)# filter url [http | port[-port] local_ip local_mask foreign_ip foreign_mask] [allow] [proxy-block]

Replace port with one or more port numbers if a different port than the default port for HTTP (80) is used. Replace local_ip and local_mask with the IP address and subnet mask of a user or subnetwork making requests. Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server or subnetwork responding to requests.

The allow option causes the security appliance to forward HTTP traffic without filtering when the primary filtering server is unavailable. Use the proxy-block command to drop all requests to proxy servers.

Enabling Filtering of Long HTTP URLs

By default, the security appliance considers an HTTP URL to be a long URL if it is greater than 1159 characters. You can increase the maximum length allowed.

Configure the maximum size of a single URL with the following command:

hostname(config)# url-block url-size long-url-size

Replace long-url-size with the maximum size in KB for each long URL being buffered. For Websense, this is a value from 2 to 4 for a maximum URL size of 2 KB to 4 KB; for Secure Computing, this is a value between 2 to 3 for a maximum URL size of 2 KB to 3 KB. The default value is 2.

Truncating Long HTTP URLs

By default, if a URL exceeds the maximum permitted size, then it is dropped. To avoid this, you can set the security appliance to truncate a long URL by entering the following command:

	hostname(config)# filter url [longurl-truncate | longurl-deny | cgi-truncate]
	The longurl-truncate option causes the security appliance to send only the hostname or IP address portion of the URL for evaluation to the filtering server when the URL is longer than the maximum length permitted. Use the longurl-deny option to deny outbound URL traffic if the URL is longer than the maximum permitted.
	Use the cgi-truncate option to truncate CGI URLs to include only the CGI script location and the script name without any parameters. Many long HTTP requests are CGI requests. If the parameters list is very long, waiting and sending the complete CGI request including the parameter list can use up memory resources and affect firewall performance.
Exempting Traffic from Filtering
	To exempt specific traffic from filtering, enter the following command:
	hostname(config)# filter url except source_ip source_mask dest_ip dest_mask
	For example, the following commands cause all HTTP requests to be forwarded to the filtering server except for those from 10.0.2.54.
	hostname(config)# filter url http 0 0 0 0 hostname(config)# filter url except 10.0.2.54 255.255.255.255 0 0
Filtering HTTPS URLs
	You must identify and enable the URL filtering server before enabling HTTPS filtering.
Note	Websense and Smartfilter currently support HTTPS; older versions of Secure Computing SmartFilter (formerly N2H2) did not support HTTPS filtering.
	Because HTTPS content is encrypted, the security appliance sends the URL lookup without directory and filename information. When the filtering server approves an HTTPS connection request, the security appliance allows the completion of SSL connection negotiation and allows the reply from the web server to reach the originating client. If the filtering server denies the request, the security appliance prevents the completion of SSL connection negotiation. The browser displays an error message such as "The Page or the content cannot be displayed."
%
Note	The security appliance does not provide an authentication prompt for HTTPS, so a user must authenticate with the security appliance using HTTP or FTP before accessing HTTPS servers.
	To enable HTTPS filtering, enter the following command:
	hostname(config)# filter https port[-port] locallP local_mask foreign_IP foreign_mask [allow]
	Replaceport[-port] with a range of port numbers if a different port than the default port for HTTPS (443) is used.
	Replace local_ip and local_mask with the IP address and subnet mask of a user or subnetwork making requests.

Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server or subnetwork responding to requests.

The allow option causes the security appliance to forward HTTPS traffic without filtering when the primary filtering server is unavailable.

Continue reading here: Creating a Regular Expression

Was this article helpful?

0 0