CSC "tunning"

[raga.fusionet]

Hi guys,

Is there a way to tune a host from inspected by the ASA CSC URL filtering rules?

For example we are inspecting the 172.16.0.0/16 network, however there is one host that needs to be excluded from the inspection/blocking.

I tried adding "denies" on the csc_out and csc_in ACLs but that didnt seem to do the trick ... it actually looked like it disabled the inspection for the whole network.

Any comments or suggestions are welcome

Thanks!

Raga

[varrao]

Hi Luis,

Lets say you are exempting the host 172.16.1.1 from being filtered, then you would need the access-list should be in the same order:

access-list csc_out line1 extended deny ip host 172.16.1.1 any

access-list csc_out line2 extended permit ip  172.16.0.0 255.255.0.0 any

access-list csc_in line1 extended deny ip any host 172.16.1.1

access-list csc_in line2 extended permit  ip any 172.16.0.0 255.255.0.0

and then match these ACL in the class map and apply the class-map in the policy map that you ace created

Thanks,

Varun

[raga.fusionet]

Hi Varun, I tried that and from ASDM all I saw was the "172.16.1.1" host. nothing about the /24 network.

Anyways it works, I was just a little concerned about the other traffic not being inspected since it is not reflected on the ASDM.

Thanks!

Raga