topic Re: ASA SSM Module inspecting and blocking Internet Radio in Network Security

ASA SSM Module inspecting and blocking Internet Radio

bjames — Sun, 10 Mar 2019 10:28:21 GMT

Hi,

I am implementing ASA's with SSM modules and I wanted confirmation that they can inspect http and block embedded traffic such as Internet Radio from being tunnelled through HTTP.

The Cisco documentation hints at this, but I would like confirmation.

We will be implementing WebSense, but I was hoping the SSM modules would be a good temporary solution.

Thanks in advance.

Re: ASA SSM Module inspecting and blocking Internet Radio

gmarogi — Wed, 21 Feb 2007 19:55:11 GMT

You can create a signature that uses the service http engine and a request regex = .ram, in monitoring -> events. As a action you can either choose "block attacker inline" which blocks user completely or better choose "TCP reset" option.

For Creating Custom Signatures follow the link

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids11/idmguide/dmsigwiz.htm

Re: ASA SSM Module inspecting and blocking Internet Radio

bjames — Thu, 22 Feb 2007 02:32:15 GMT

I will give it a try, I didn't realize it used a .ram suffix.

Re: ASA SSM Module inspecting and blocking Internet Radio

Andrew Ossipov — Fri, 23 Feb 2007 04:48:07 GMT

Hello,

Are you using AIP-SSM (Intrusion Prevention) or CSC-SSM (Content Security)?

Andrew

Re: ASA SSM Module inspecting and blocking Internet Radio

bjames — Sat, 24 Feb 2007 22:29:15 GMT

IPS - SSM

I tried filtering on REGX, but it will get every hit of .ram, so it's not too accurate.

Re: ASA SSM Module inspecting and blocking Internet Radio

Andrew Ossipov — Sun, 25 Feb 2007 06:55:51 GMT

The AIP-SSM module is not designed for content filtering. You should probably try CSC-SSM for that, but you can also use Modular Policy Framework (MPF) on the ASA itself to accomplish the task:

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/conf_gd/firewall/mpc.htm

It's even simpler through ASDM, where you have some pre-defined maps that allow you to block streaming audio/video over HTTP.

Andrew

Re: ASA SSM Module inspecting and blocking Internet Radio

bjames — Sun, 25 Feb 2007 14:34:39 GMT

Thanks, that's kind of what I figured. We want the IPS so we will stay with these modules, and use Websense for the filtering.

My understanding of the SSM module is it provide much more inspection capabilities that the MPF inspects (it will do them all but provides more in-depth control)

Thanks