topic Re: What is a good webfilter to use??? in Application Networking

What is a good webfilter to use???

cisco_himg — Sun, 26 Jul 2009 14:56:15 GMT

I am considering a Barracuda web filter, but i did see others such as IronPort, SonicWall.

I am however, NOT considering websense. I have it and currently hate it. I would rather have hardware rather than software.

Any ideas?

Re: What is a good webfilter to use???

Collin Clark — Mon, 27 Jul 2009 18:46:23 GMT

I have a customer that loves Barracuda. I have another customer that loves IronPort. We've used webwasher and BlueCoat, both work find, just expensive. Note that Webwasher can not load balance natively. In the past I've used Squid and had good success with it.

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 18:54:40 GMT

Awesome, I just purchase a Barracuda. I already have their Spam Firewall, and love it, so I am looking forward to getting it.

I am disappointed that I cant use it over a trunk link, but i do have a question..Take a look at the attached pic.

Our MAIN Vlan 17 is the one we use, all the other ones are for our tennants. If I move the Gig 0/1.17 to Gig 0/3, would that work?

Would there be any other settings I would need to do? and would you recommend?

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 18:55:52 GMT

SOrry, i forgot to attached the pic. Here it is. 🙂

Re: What is a good webfilter to use???

Collin Clark — Mon, 27 Jul 2009 18:58:47 GMT

That should work fine. Just remember to set your security level on the interface, the ACL, and any NAT.

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 19:05:56 GMT

I understand putting our security level on the Interface, but what do you mean by ACL, and NAT.. I thought they would just see the interface once i configured it and just go with it. This is my first time setting this up, so I am still learning. I thought the ACL and NAT settings would stay the same?

Re: What is a good webfilter to use???

Collin Clark — Mon, 27 Jul 2009 19:08:40 GMT

They can. For the ACL you will need to move it to the new interface. NAT will most likely stay the same as long as your address space doesn't change (which I assumed it wouldn't, but just wanted to mention it.)

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 19:13:12 GMT

Ok, yes the NAT will stay the same...Can you give me a example of which ones i need to move? Keep in mind, i am new 🙂

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 19:13:45 GMT

and all subnets are staying the same. 172.17.0.2

Re: What is a good webfilter to use???

Collin Clark — Mon, 27 Jul 2009 19:18:36 GMT

Let's say you have an ACL (let's call it inside_access) applied to the inside interface. We remove it from the old interface (inside) and apply it to the new interface (inside_1).

no access-group inside_access in interface inside

access-group inside_access in interface inside_1

Even if you keep the same name for the interfaces, when the original one is deleted the ACL will automatically be removed so you will still ehve to re-apply it.

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 19:25:39 GMT

Ok i understand, however, these are all my ACL's, i dont see where it says Interface ******* to change it...see attached....

Re: What is a good webfilter to use???

Collin Clark — Mon, 27 Jul 2009 19:31:35 GMT

It's only a partial config and the relevant info is a little further down. However you have an ACL named inside_out that is probably applied to the inside interface. Try this command and see if you see where the ACLs are applied-

show run | i access-group

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 19:34:03 GMT

himg-asa# show running-config | i access-group

access-group outside_in in interface outside per-user-override

access-group RESTRICT_SMTP in interface inside_vlan17

access-group dmz_in in interface dmz

Re: What is a good webfilter to use???

Collin Clark — Mon, 27 Jul 2009 19:40:26 GMT

Cool. The ACL RESTRICT_SMTP is applied to the inside_vlan17 interface. When you move the IP over to gi0/3, remove the ACL then apply to the new interface.

no access-group RESTRICT_SMTP in interface inside_vlan17

access-group RESTRICT_SMTP in interface new_inside_vlan17

Re: What is a good webfilter to use???

cisco_himg — Mon, 27 Jul 2009 19:44:25 GMT

THank you!!! I rated you 5!..

THanks for taking time out of your day for me...

Dustin

Re: What is a good webfilter to use???

Collin Clark — Mon, 27 Jul 2009 19:48:50 GMT

No problem. Good luck with the cut.