Cisco 2921 Intrusion Prevention

[Dimitris Mingos]

Hello,

I have a cisco 2921 Router with intrusion prevention license installed. I want to ask if there is a way in the signatures database to

block users from accessing specific websites like facebook,yahoo etc, or the only way this can happen is by using access-lists??

Thank you.         

[lcambron]

Hello,

Neither the IPS nor the ACLs are meant to block Websites.

Web pages like facebook and yahoo use https which is encrypted and can't be inspected by this features.

You can block by IP address by this is not a robust solution and can take long time and configuration since a single Site can have many IP addresses.

You can alse use regex on the router but you will have the same issue with https, only http can be blocked.

A better solution will be Websense.

Regards,

Felipe.

[_____Adam]

Felipe's reply is correct.  However, if you do want to write an IPS signature to block a website you can use the following guide to do so:

Cisco Intrusion Prevention System Engine Quick Reference

-Blocking HTTP Websites

http://www.cisco.com/web/about/security/intelligence/ips_sig_quick_ref.html#4

[Tagir Temirgaliyev]

palo alto can decrypt and inspect fttps