Websense URL-Filter via L2L VPN Issues

[dan hale]

Hi All, We have a remote site that we need to filter via Websense and URL-Filter. L2L is up and works great. However, I cannont seem to get the remote site filtered via the URL-Filter. I followed the below guide from websense but, still cannont seem to get it to work.

http://www.websense.com/support/article/kbarticle/How-do-I-configure-a-remote-ASA-PIX-to-communicate-with-Websense-via-a-VPN-connection

In short the Central and Remote sites look like this:

(LAN Central) 172.31.160.0 /20 ---- (ASA Outside IP) 192.168.1.2 ----Internet----- (ASA outside IP) 192.168.2.2 ------(LAN Remote) 172.31.60.0 /20

Websense Server at Central IP

172.31.160.244

If I issue the " url-server statistics" the websense server shows as down on the remote end.

In short the guide wants you to include the outside address of the firewalls in the L2L and to make sure you NoNat between the LAN and Outside interfaces of the ASA's. As far as I can tell I've done what they have asked but, still comming up short.

I've attached the sanatized configs of both Central and Remote ASA's. Can anyone take a look and see if I'm missing anything from the firewall standpoint?

Thanks in advance,

Dan

[Jennifer Halim]

The remote site URL filter command should source it from interface: inside, instead of outside so it actually routes via the L2L tunnel.

It should say:

url-server (inside) vendor websense host 172.31.160.244 timeout 30 protocol TCP version 1 connections 5

Hope that helps.

[dan hale]

Thanks Jennifer for your help....Unfotunalty even with the above this did not work. We have a back up Pont to Point T1 that I forced the traffic to go out instead. Once I forced it through the T1 the command: "show URL Statictics" showed that the websense server was registered.

Thanks,

Dan

[derly_ali]

Hi Playne,

I recently solve an issue like yours putting the command 'management-access inside' in the configure mode.

the teory is that the ASA needs to know the websense from the inside interface with the command that propose Jennifer,

i hope this resolve your problem,

regards,

derly_ali