topic Re: Web filter in Network Security

Web filter

1salvarez — Mon, 11 Mar 2019 19:58:31 GMT

We upgraded to ASA IOS 8.2.4 from 8.0.2. When the commands "filter https 443 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow" and "filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow" are added the we lose internet access. We're using WebSense and command "url-server (inside) vendor websense host 192.168.1.180 timeout 30 protocol TCP version 4 connections 5"

Thank you.

Re: Web filter

PAUL GILBERT ARIAS — Mon, 28 Feb 2011 18:20:26 GMT

Is websense properly configured? What the asa sees? Do a show url-server statistics. If it is up then the allow will not permit traffic.

Sent from Cisco Technical Support iPhone App

Re: Web filter

1salvarez — Mon, 28 Feb 2011 18:35:42 GMT

"sh url-ser sta"

Server Statistics:
--------------------
192.168.1.180 UP
Vendor websense

I've tried shutting down the server and we're still not allowed online. Only after we remove the filter command are we allowed online.

Re: Web filter

PAUL GILBERT ARIAS — Mon, 28 Feb 2011 18:57:08 GMT

once you shut down the server how long you waited? ASA has to be aware that the server is down.

Re: Web filter

1salvarez — Mon, 28 Feb 2011 19:09:41 GMT

"sh url-ser sta"

Server Statistics:
--------------------
192.168.1.180 DOWN
Vendor websense

Waited for up to 10 after it showed it down. Thinking it may be a bug in the IOS.

Re: Web filter

PAUL GILBERT ARIAS — Mon, 28 Feb 2011 19:21:47 GMT

you are testing with HTTPS traffic right?

Re: Web filter

1salvarez — Mon, 28 Feb 2011 19:25:06 GMT

Both. This wasn't a problem for us on 8.0. Thinking I'm going to upgrade to 8.4 in hopes of it working.

Re: Web filter

PAUL GILBERT ARIAS — Mon, 28 Feb 2011 19:30:11 GMT

Be aware that 8.4 has differences in NAT. Check the release notes before.

Re: Web filter

1salvarez — Tue, 03 May 2011 20:31:38 GMT

Turns out we had a bad ASA. Cisco replaced it.