Avatar of Chris McGinnis
Chris McGinnisFlag for United States of America

asked on 

Prepare for egress filtering on Cisco ASA

We currently have a Cisco ASA running software version 9.1.  We need to implement egress filtering.  I know some of the applications/ports that need to be allowed out of our network.  However, I don't want to implement egress filtering and block outbound traffic that I'm not aware of that is required for business.

Is there an easy way to find out what some of our traffic patterns are on the firewall so I can get an idea of what outbound ports might currently be used?
CiscoNetworkingNetwork Security

Avatar of undefined
Last Comment
FlatheadIT
Avatar of Vasant Patel
Vasant Patel
Flag of United States of America image

Just get a WebProxy and filter through that. You don't want to use ASA for web filtering. For inbound use ASA.
ASKER CERTIFIED SOLUTION
Avatar of Donboo
Donboo
Flag of Denmark image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Avatar of FlatheadIT
FlatheadIT

You can monitor egress traffic using the syslog or you can setup a filter to watch outbound traffic - only for a very small organization (ASDM.)  However, without syslog this will be cumbersome.  

That said, if there are known sites you do not wish your users to hit, there are tools available to block malware (Botnet filter for one) and access to sites your organization deems unacceptable.  Here are some options in a CISCO environment:

Sourcefire will do this type of monitoring/blocking - as will PRSM - this is not easy with PRSM and it is even more cumbersome with an active/standby pair setup.  I have not used firepower (sourcefire) for this only PRSM.  But it works.  If you wish to take it one step further, setup CISCO CDA (this is an OVA vmware virtual appliance - formerly this was an AD agent) then you can setup AD groups with rules to block access to content by type and by url for AD groups - this comes in handy if you have a need for access to certain sites for Law enforcement etc.  that would be blocked for other departments in your organization.  *** Warning here - CISCO Licenses and modules may be required for this. ***  Make sure your vendor is aware of the licensing on CISCO.  It is often the case where the cost is not the hardware - it is the licensing and smartnet.
FYI end of life on PRSM is August 2018 - so don't go with PRSM - you should use sourcefire.  Lesson learned here.

You can also block outgoing traffic via IP from an ASA (For example - you wish to block the country of China - you can get the list of IP's in China, create a network object group, then use a a text file via cli or command line in ASDM (Multiple line) to place them in the firewall.  You can then add a rule to block outgoing traffic to those IP addresses (ingress and egress with rules on the firewall.)
Networking
Networking

Networking is the process of connecting computing devices, peripherals and terminals together through a system that uses wiring, cabling or radio waves that enable their users to communicate, share information and interact over distances. Often associated are issues regarding operating systems, hardware and equipment, cloud and virtual networking, protocols, architecture, storage and management.

102K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews

TRUSTED BY

IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo