Solved

Configuring Cisco ASA to monitor websites visited

Posted on 2010-11-26
5
2,271 Views
Last Modified: 2012-05-10
Hello,

our company has a Cisco ASA 5510 with optional CSC-10 content security module. All is configured pretty basically. I have been asked by one of the directors to provide information on what websites some of our users are visiting. Could someone please explain how I set up this monitoring and reporting? I assume it is possible! We have just one external IP address, all machines are PAT'd to this outside address.

Thanks in advance,

Alasdair Barclay
0
Comment
Question by:Alasdairb
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 33

Accepted Solution

by:
MikeKane earned 500 total points
ID: 34218079
2 Step process here.  

#1) Setup an inspect http on the class inspection so that syslog will record that info.
#2)  You have to run the syslog files past a log analyzer so that the output can be summarized... (i.e. Sawmill Log analyzer).  


Here is some reading
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008085283d.shtml
http://www.velocityreviews.com/forums/t537122-asa-http-inspection-and-url-filtering.html
http://www.sawmill.net/formats/cisco_pix.html
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 34220206
You could install a 30 day trial of websense (www.websense.com), use logging mode and enable filter http on the ASA.
0
 

Author Comment

by:Alasdairb
ID: 34222003
Hi all,

Thanks for the response, I will have a look at the links and get back to you.

Thanks,

Alasdair
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 34230387
How did it go?   Any Luck?
0
 

Author Closing Comment

by:Alasdairb
ID: 34265716
Hi all,

thanks to all for the input. I apologise for not getting back sooner, recent events have stopped me from following this up, which is a shame as I have asked you for help.

I've also ordered two Cisco ASA books from Computermanuals which have just arrived.

I've taken a quick look at all the links, but not read them thoroughly, I need to set aside a couple of days for this, my knowledge of ASA's is fairly fundamental.

Points go to MikeKane as he was the first to reply with an option that uses existing tools, due to my lack of time I have to assume the completeness and accuracy is all there. Unftunately the company would not be willing to buy additional software like websense, but thanks for the pointer
RPPreacher.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question