C H A P T E R 12

Content Filtering with the Cisco PIX Firewall

Up to now, you have focused on how to configure the PIX and how to protect against unwanted traffic from outside in. This chapter focuses specifically on outbound traffic and content filtering—traffic moving from inside out.

More and more companies today have some form of network policy in place. Websites that are not related to their business or that are otherwise considered inappropriate are prohibited for use by their employees. This chapter discusses how the Cisco PIX Firewall mitigates some of the threats posed by Java applets and ActiveX objects and how Cisco PIX Firewall enforces URL filtering.

“Do I Know This Already?” Quiz

The purpose of this quiz is to help you determine your current understanding of the topics covered in this chapter. Write down your answers and compare them to the answers in Appendix A. The concepts in this chapter are the foundation for much of what you need to understand to pass the CSPFA Certification Exam. Unless you do exceptionally well on the “Do I Know This Already?” pretest and are 100% confident in your knowledge of this area, you should read through the entire chapter.

1What two URL filtering servers does the PIX work with?

2What command filters out Java applets from HTML pages?

3Why are Java applets and ActiveX objects considered a threat?

4How does PIX filter Java applets and ActiveX objects?

5True or false: PIX blocks HTML tags split across network packets or tags longer than the number of bytes in the MTU.

6What is the command to designate or identify the filtering server?

7True or false: Cisco PIX Firewall version 5.3 supports N2H2.

8What PIX Firewall version supports the Websense filtering server?

9What is the longest URL filter, in bytes, that is possible with Cisco PIX Firewall version 6.1 and older?

246 Chapter 12: Content Filtering with the Cisco PIX Firewall

10What is the longest URL filtering that is supported by Cisco PIX Firewall 6.2?

11What is the command to filter URLs?

12If the filtering server does not respond before the web content server does, the reply from the web content server is dropped. What can you do to avoid this problem?

ActiveX controls and Java applets are designed to make the browsing experience more interactive. Based on the Component Object Model (COM), ActiveX controls are written for a specific platform of Microsoft Windows. When the user displays a page containing ActiveX or Java, the browser downloads the control dynamically. ActiveX controls are native programs, so they can do all the things that one local program can do. For example, they can read and write to the hard drive, execute programs, perform network administration tasks, and determine which system configuration they are running on. While ActiveX and Java applets can perform powerful tasks, they can also be used maliciously to damage systems.

One way to prevent the threats posed by ActiveX Java applets is at the browser or user level. Users can configure their web browsers not to run ActiveX or Java applets. Although you can disable ActiveX and Java applets within the browser, this requires a lot of effort for a large enterprise network. In these cases, it is easier to prevent the ActiveX objects and Java applets before they reach the browser.

When configured for filtering, the Cisco PIX Firewall filters or renders ActiveX objects and Java applets ineffective from HTML web pages before they reach the browser. Java and ActiveX filtering of HTML files is performed by selectively replacing the <APPLET> and </APPLET> and <OBJECT CLASSID> and </OBJECT> tags with comments.

Filtering Java Applets

The filter java command filters out Java applets that return to the Cisco PIX Firewall from an outbound connection. The user still receives the HTML page, but the web page source for the applet is commented out so that the applet cannot execute:

filter java port[-port] local_ip mask foreign_ip mask

The following example specifies that Java applet blocking applies to web traffic on port 80 from local subnet 10.10.10.0 and for connections to any foreign host:

filter java http 10.10.10.0 255.255.255.0 0 0

Filtering Java Applets 247

Table 12-1 describes the different parameters for the filter command.

Table 12-1 filter Command Parameters

250 Chapter 12: Content Filtering with the Cisco PIX Firewall

This policy filters all HTTP traffic with the exception of HTTP traffic originating from host 10.10.10.20.

Websense protocol version 4 contains the following enhancements:

•URL filtering allows the Cisco PIX Firewall to check outgoing URL requests against the policy defined on the Websense server.

•Username logging tracks the username, group, and domain name on the Websense server.

•Username lookup lets the Cisco PIX Firewall use the user authentication table to map the host’s IP address to the username.

There are instances in which the web server replies to a user HTTP request faster than the URL filtering servers. In these instances, the url-cache command provides a configuration option to buffer the response from a web server if its response is faster than that from the N2H2 or Websense filtering service server. This prevents the web server’s response from being loaded twice, improving throughput. The syntax of the url-cache command is as follows:

url-cache {dst | src_dst} size kbytes

Table 12-2 describes the parameters for the url-cache command.

Table 12-2 url-cache Command Parameters

Use the url-cache command to enable URL caching, set the size of the cache, and display cache statistics.

Caching also stores URL access privileges in memory on the Cisco PIX Firewall. When a host requests a connection, the Cisco PIX Firewall first looks in the URL cache for matching access privileges instead of forwarding the request to the N2H2 or Websense server.

The clear url-cache command removes url-cache command statements from the configuration, and the no url-cache command disables caching.

Filtering URLs 251

Filtering Long URLs

Cisco PIX Firewall version 6.1 and earlier versions do not support filtering URLs longer than 1159 bytes. Cisco PIX Firewall version 6.2 supports filtering URLs up to 6000 bytes for the Websense filtering server. The default is 2000 bytes. In addition, Cisco PIX Firewall version 6.2 introduces the longurl-truncate and cgi-truncate parameters to allow handling of URL requests longer than the maximum permitted size. The format for these options is as follows:

filter url [http | port[-port] local_ip local_mask foreign_ip foreign_mask] [allow] [proxy-block] [longurl-truncate | longurl-deny | cgi-truncate]

•longurl-truncate causes the Cisco PIX Firewall to send only the host name or IP address portion of the URL for evaluation to the filtering server when the URL is longer than the maximum length permitted.

•longurl-deny denies outbound traffic if the URL is longer than the maximum permitted.

•cgi-truncate sends a CGI script as the URL.

Cisco PIX Firewall version 6.2 supports a maximum URL length of 1159 bytes for the N2H2 filtering server. To increase the maximum length of a single URL (for Websense only), enter the following command:

url-block url-size size

The value of the size variable is 2 to 6 KB.

Viewing Filtering Statistics and Configuration

The show url-cache command with the stat option displays the URL caching statistics. Example 12-2 demonstrates sample output from this command.

Example 12-4 show url-cache Command Output

PIX(config)# show url-cache stat

URL Filter Cache Stats

The significant fields in this output are as follows:

•Size—The size of the cache in kilobytes, set with the url-cache size option.

•Entries—The maximum number of cache entries based on the cache size.

•In Use—The current number of entries in the cache.

•Lookups—The number of times the Cisco PIX Firewall has looked for a cache entry.

•Hits—The number of times the Cisco PIX Firewall has found an entry in the cache.

252 Chapter 12: Content Filtering with the Cisco PIX Firewall

You can view more statistics about URL filtering and performance with the show urlserver stats and show perfmon commands, respectively. Example 12-3 shows output from show url-server stats.

Example 12-5 show url-server stats Command Output

PIX(config)# show url-server stats

Example 12-4 shows output from the show perfmon command.

Example 12-6 show perfmon Command Output