PIX w/Websense and URL-CACHE

[sjamison]

Does anyone use this succesfully? I called Websense up and they said I had to get with Cisco to figure out why it doesnt work. They no longer recommend it, and the document is over 3 yrs old that I was following.

Currently the url-cache is turned on, but im not getting any hits. Is it worth it to turn it on? Or does it just bring more problems than its worth?

[nkhawaja]

Folks have been using it successfully. URL-Cache is only successfull if it is turned on from WEBSENSE server. try adding url-block block <> command

try udp if tcp is giving issues

what does "show url-server stat" shows

[sjamison]

Where do you turn it on within Websense? If one website is permitted for one user, and denied for another, will the cache permit it for the denied user as well? We are using Websense 5.1 right now... with PIX 6.3(1)

roadblock(config)# url-cache dst 128

roadblock(config)# exit

roadblock# show url-cache stat

URL Filter Cache Stats

----------------------

Size : 128KB

Entries : 221

In Use : 0

Lookups : 187

Hits : 0

Hit Rate : 0

[nkhawaja]

I don't know from where you turn it on on WenSense. Cache will not permit for the deny user.

could you use "url-cache src_dst 128"

also use the other command i sent you.

thanks

Nadeem

[sjamison]

Hmm I tried the command you referenced. Didnt seem to make a difference. Called Websense and they say its just a command you turn on in the PIX. The PIX does all the caching so its up to it to learn....

# show url-server stat

URL Server Statistics:

----------------------

Vendor websense

URLs total/allowed/denied 841614/839154/2460

HTTPSs total/allowed/denied 0/0/0

FTPs total/allowed/denied 0/0/0

URL Server Status:

------------------

xx.xx.xx.xx UP

URL Packets Sent and Recieved Stats:

-----------------------------------

Message Sent Recieved

STATUS_REQUEST 115508 115434

LOOKUP_REQUEST 851932 851702

LOG_REQUEST 0 NA

-----------------------------------

Here is my url-server command:

url-server (inside) vendor websense host xx.xx.xx.xx timeout 5 protocol TCP version 1

Did you want me to change it to UDP?