PIX|Web Sense and chat programs

[rmears]

Hello Cisco people

We are using Web Sense to block most of the Sites that we feel necessary but have had problems with programs like AOL, MSN, ICQ chat programs. So I am going to stop this at the PIX and was wonder who out there had blocked Chat programs in the enterprise, and methods used.

I fully understand the steps needed to block what is needed on the PIX but was wanting to hear horror storied or problems you might have encountered. I would also like to know what sites (address\protocols) you had to block to stop these programs because some are http based. (AIM, MSN,ect).

For those of you who have applied rules to the inside interface of the pix, did you notice any performance issues or any other problem related to having all outbound traffic filtered?

Thank you

Thanks

Rob Mears III, CCNP, MCSE, CNE, NNCDS, NNCSS, NNCPS, MCP+I, A+

Technical Mercenary

Valor Telecom.com

[yusuff]

To block chat programs, simply use access-list on PIX.

Some of the common chat programs use following ports

**********common chat ports**********

tcp 6667 (irc) 6660- 6670 (the default being 6667).

tcp 6665-6669 (common IRC)

tcp 5190 (aol)

tcp 5190, dyn >=1024 (aol ICQ)

tcp/udp 5190-5193 (aol)

tcp 1863 (msn)

tcp/udp 4020 (ichat)

tcp 5000-5001 and udp 5000-5010 (Yahoo voice chat)

tcp 5050 (Yahoo messages)

tcp 5100 (Yahoo Webcams)

Hope that helps.

R/Yusuf

[rmears]

Thank you very much

I applied to the pix and BOOM!

Messangers no workie, and my phone starts ringing.

Now its time to get back to work.

Thanks for your help, it worked great.

Rob

[jcin]

Can I apply this access-list on PIX to block IRC :

access-list acl_in deny tcp any any range 6660 6670

access-list acl_in permit ip any any

access-group acl_in in interface inside

TIA,

Janto