Hi Richard,
I hope these information will help you:
1. Regarding CX: CX was "the new thing" until Cisco acquired Sourcefire and launch Cisco ASA Next Generation Firewall - Cisco ASA with FirePOWER services about a year later.
You can't even find link to CX module on products page on www.cisco.com anymore.
2. ASA can do some limited URL filtering based on service policies.
Here is an example configuration you can test in your environment:
- change "192.168.1.3" to IP address permitted to communicate with web server
- change "domain.tld" do real web server fqdn
- change interface "inside" to your interface name
access-list inside_mpc line 1 extended permit ip host 192.168.1.3 any4
regex domain-tld "domain.tld"
class-map type inspect http match-all blocked-domains
match request uri regex domain-tld
policy-map type inspect http allow-domains
parameters
protocol-violation action log
class blocked-domains
drop-connection log
class-map inside-class
match access-list inside_mpc
policy-map inside-policy
class inside-class
inspect http allow-domains
service-policy inside-policy interface inside
And now deny for all other network hosts in your network:
- change "192.168.1.0" and "255.255.255.0" to IP address of the network and the netmask denied to communicate with web server
- change interface "inside" to your interface name
access-list inside_mpc_1 line 1 extended permit ip 192.168.1.0 255.255.255.0 any4
policy-map type inspect http block-domain-network
parameters
protocol-violation action drop-connection log
class blocked-domains
drop-connection log
class-map inside-class1
match access-list inside_mpc_1
policy-map inside-policy
class inside-class1
inspect http block-domain-network
You can add additional URL addresses by adding additinal regexes to class-map "blocked-domains".
I hope I didn't make any grammatical error :)
3. Regarding "When you mention a web security applicance is that like Websense or Secure Computing Smart Filter?"
By web security appliance I've ment Cisco WSA - former IronPort Web Security. Cisco acquired IronPort some years ago and now these products are called web security appliance (web proxy filtering) and email security appliance (antispam solution). For bigger environments there are also management appliances available.
IronPort Web Security aka. Cisco Web Security Appliance offers besides URL filtering and HTTPS inspection antimalware protection, IP reputation filtering and many many more.
Really great product worth every cent of the investment. It can be run on dedicated appliance or as a virtual appliance in your VMware environment. You can easily get the demo and evaluation license.
4. Regarding Sourcefire IPS/IDS: yes, Cisco acquired this company in 2013 and now integrated solution into Cisco ASA as Firewall Next Gen.: it offers application control, url filtering, antimalware and IPS protection.
You can still purchase and use traditional standalone IPS/IDS sensors/appliances, AMP etc. but this is not the case in your situation.
