Cisco 7604 Configuration Guide - Page 364

Filtering URLs and FTP Requests with an External Server Chapter 18 Applying Filtering Services Filtering URLs and FTP Requests with an External Server This section describes how to filter URLs and FTP requests with an external server. This section includes the following topics: • URL Filtering Overview, page 18-4 • Identifying the Filtering Server, page 18-4 • Buffering the Content Server Response, page 18-6 • Caching Server Addresses, page 18-6 • Filtering HTTP URLs, page 18-7 • Filtering HTTPS URLs, page 18-8 • Filtering FTP Requests, page 18-9 URL Filtering Overview You can apply filtering to connection requests originating from a more secure network to a less secure network. Although you can use access lists to prevent outbound access to specific content servers, managing usage this way is difficult because of the size and dynamic nature of the Internet. You can simplify configuration and improve FWSM performance by using a separate server running one of the following Internet filtering products: • Websense Enterprise for filtering HTTP, HTTPS, FTP, and long URL filtering. • Secure Computing SmartFilter (formerly N2H2) for filtering HTTP, and HTTPS filtering. Although FWSM performance is less affected when using an external server, users may notice longer access times to websites or FTP servers when the filtering server is remote from the FWSM. When filtering is enabled and a request for content is directed through the FWSM, the request is sent to the content server and to the filtering server at the same time. If the filtering server allows the connection, the FWSM forwards the response from the content server to the originating client. If the filtering server denies the connection, the FWSM drops the response and sends a message or return code indicating that the connection was not successful. If user authentication is enabled on the FWSM, then the FWSM also sends the username to the filtering server. The filtering server can use username filtering settings or provide enhanced reporting regarding usage. Identifying the Filtering Server You can identify up to four filtering servers per context. The FWSM uses the servers in order until a server responds. You can only configure a single type of server (Websense or N2H2) in your configuration. Note You must add the filtering server before you can configure filtering for HTTP or HTTPS with the filter command. You must also remove all filtering command before you remove the filtering servers from the configuration. 18-4 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01