topic ASA webfilter using regex in Network Security

ASA webfilter using regex

Mohd Khairul Nizam — Tue, 12 Mar 2019 00:03:42 GMT

Hi all,

I have a ASA 5510, it does webfilter using regular expression. (http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml)

I block "\.facebook\.com" and it was successfull. But somehow other users is using https to access to FB.

Any ideas on how do i filter HTTPS?

ASA webfilter using regex

lcambron — Wed, 03 Oct 2012 22:04:37 GMT

Im afraid this is not possible with the ASA, since the connection is encrypted, the ASA cannot inspect it.

You would need a different solution like websense.

Regards,

Felipe.

Re: ASA webfilter using regex

Karsten Iwen — Wed, 03 Oct 2012 22:34:24 GMT

If you are runing 8.4, then you can filter that in your ACL based on FQDN: https://supportforums.cisco.com/docs/DOC-17014

Sent from Cisco Technical Support iPad App

ASA webfilter using regex

Mohd Khairul Nizam — Thu, 04 Oct 2012 01:40:06 GMT

currently I'm using ASA Version 8.0(3). Does it mean i need to upgrade the firmware to 8.4 then I able to perform the https filter as you describe above??

ASA webfilter using regex

Karsten Iwen — Thu, 04 Oct 2012 06:36:11 GMT

yes, to filter based on fqdn you need at least version 8.4(2). But be aware of the increased memory-requirements starting with version 8.3: http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.html#wp454755

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ASA webfilter using regex

Mohd Khairul Nizam — Wed, 12 Dec 2012 04:12:53 GMT

OK tq,

I will try and see the result.