Prepare for egress filtering on Cisco ASA

We currently have a Cisco ASA running software version 9.1.  We need to implement egress filtering.  I know some of the applications/ports that need to be allowed out of our network.  However, I don't want to implement egress filtering and block outbound traffic that I'm not aware of that is required for business.

Is there an easy way to find out what some of our traffic patterns are on the firewall so I can get an idea of what outbound ports might currently be used?
LVL 1
RickAstleyAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

vipeliteCommented:
Just get a WebProxy and filter through that. You don't want to use ASA for web filtering. For inbound use ASA.
0
DonbooCommented:
On the ASA there is no easy way to do this. There are no monitoring mode on ACLs. if you want to know the traffic patterns without blocking i´d suggest you use CX or Firepower in monitoring mode.

An ACL with permit IP any any log sent to a syslog will probably generate too much info....
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
FlatheadITCommented:
You can monitor egress traffic using the syslog or you can setup a filter to watch outbound traffic - only for a very small organization (ASDM.)  However, without syslog this will be cumbersome.  

That said, if there are known sites you do not wish your users to hit, there are tools available to block malware (Botnet filter for one) and access to sites your organization deems unacceptable.  Here are some options in a CISCO environment:

Sourcefire will do this type of monitoring/blocking - as will PRSM - this is not easy with PRSM and it is even more cumbersome with an active/standby pair setup.  I have not used firepower (sourcefire) for this only PRSM.  But it works.  If you wish to take it one step further, setup CISCO CDA (this is an OVA vmware virtual appliance - formerly this was an AD agent) then you can setup AD groups with rules to block access to content by type and by url for AD groups - this comes in handy if you have a need for access to certain sites for Law enforcement etc.  that would be blocked for other departments in your organization.  *** Warning here - CISCO Licenses and modules may be required for this. ***  Make sure your vendor is aware of the licensing on CISCO.  It is often the case where the cost is not the hardware - it is the licensing and smartnet.
FYI end of life on PRSM is August 2018 - so don't go with PRSM - you should use sourcefire.  Lesson learned here.

You can also block outgoing traffic via IP from an ASA (For example - you wish to block the country of China - you can get the list of IP's in China, create a network object group, then use a a text file via cli or command line in ASDM (Multiple line) to place them in the firewall.  You can then add a rule to block outgoing traffic to those IP addresses (ingress and egress with rules on the firewall.)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.