Advantage of ASA with Websense or N2H2

[nabil_mdn1]

Hi guys,

I can see from the cisco documents that ASA will work with Websense and N2H2 for URL filtering  & require some specific URL commands.Does it mean that ASA will not work with any other Web filtering appliances/devices like Bluecoat,Windows ISA,etc.

If ASA will work with others what is the benefit of adding these URL commands on ASA & why do we enmphsis more on Websense and N2H2.

If ASA wont work with others then it is a big drawback I believe.

Please advice.

[Anu M Chacko]

Hi,

ASA supports Smartfilter(previously N2H2) and Websense as URL Filtering servers. You can use Bluecoat, Windows ISA as proxy servers.Here is a document on how to do URLF without a Wwbsense or Smartfilter:

https://supportforums.cisco.com/docs/DOC-1268

Hope this is clear.

Regards,

Anu

P.S.Please mark this question as answered if it has been resolved. Do rate helpful posts. Thanks!

[nabil_mdn1]

Dear Anu,

I understand that ASA can do URL filtering by its own.My doubt is something else - CISCO documemenation never says anything about intergrating ASA with other URL filtering appliances/devices like Bluecoat,ISA,etc.The emphasis is always on Websense & N2H2.What does it mean ?

ASA cannot work with other filtering devices like Bluecoat/ISA URL ? Please clarify.

[Anu M Chacko]

Hi Nabil,

That's right. ASA supports only Websense and Smartfilter vendors for URL Filtering.

Hope this is clear. Let me kow if you have more queries.

Regards,

Anu

P.S.Please mark this question as answered if it has been resolved. Do rate helpful posts. Thanks!

[nabil_mdn1]

Dear Anu,

Well yesterday I happened to be on a site where ASA is working with ISA Server and there was no flashy "Filter URL" commands used.ISA was connected to a dmz and a policy which allows traffic from inside to that dmz on a particular proxy port.

Now that I know it will work with ISA without "Filter URL" conmmands I am still confused why we need these "Filter URL" commands with Websense.

[Anu M Chacko]

Hi Nabil,

I understand that you're using the Windows ISA as a proxy server, which is supported as i mentioned before. This is not URL Filtering. So, all the connections are now proxied via this server and the ASA has no role in determining if the website is to be allowed or not.

With a Websense, the ASA sends a copy of your packet to the Websense server and depending on the policies, the website is either allowed or not allowed, which is called URL Filtering. So there is no proxy-ing.

Hope this is clear. Do let me know if you have more questions.

Regards,

Anu

P.S.Please mark this question as answered if it has been resolved. Do rate helpful posts. Thanks!

[nabil_mdn1]

Dear Anu,

Thank you for the clarifications.

What I meant was that ISA will work as a Proxy+URL Filtering device (as far as I know) .

[Anu M Chacko · Accepted solution]

Hi Nabil,

The Websense is a vendor which provides URL Filtering services in conjunction with ASA checks. You can control all rules for URL filtering on the ASA itself. When you use a Windows ISA, the ASA has nothing to do with URL filtering.

Hope this is clear.

Regards,

Anu

P.S.Please mark this question as answered if it has been resolved. Do rate helpful posts. Thanks!

[nabil_mdn1]

Dear Anu,

1 more doubt if I have an ASA+Websense setup and if I configure the ASA excatly as if there was an ISA will it work (meaning I dont want to use any "Filter URL" commands) ???

[Anu M Chacko · Accepted solution]

Hi Nabil,

Nope. You have to configure the ASA to send the packets to the Websense server by using the filter URL commands.

Hope this is clear.

Regards,

Anu