Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 143)

3-31

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Filtering Outbound Connections

To remove a specific object group, use the following command:

pix(config)# no object-group grp_id

Replace grp_id with the identifier assigned to the specific group you want to remove.

Note You cannot remove an object group or make an object group empty if it is used in a command.

Filtering Outbound Connections

This section describes ways to filter web traffic to reduce security risks or inappropriate use and includes

the following topics:

• Filtering ActiveX Objects, page 3-31

• Filtering Java Applets, page 3-32

• Filtering URLs with Internet Filtering Servers, page 3-32

ActiveX objects and Java applets may pose security risks because they can contain code intended to

attack hosts and servers on a protected network. You can disable ActiveX objects and remove Java

applets with the PIX

Firewall filter command.

You can use the filter command to work with a URL filtering server to remove URLs that are

inappropriate for use at your site.

Filtering ActiveX Objects

ActiveX controls, formerly known as OLE or OCX controls, are components you can insert in a web

page or other application. These controls include custom forms, calendars, or any of the extensive

third-party forms for gathering or displaying information. As a technology, ActiveX creates many

potential problems for network clients including causing workstations to fail, introducing network

security problems, or being used to attack servers.

The syntax of the command for filtering ActiveX objects is as follows:

filter activex port[-port] |except local_ip mask foreign_ip mask

This command blocks the HTML <object> commands by commenting them out within the HTML web

page. This functionality has been added to the filter command with the activex option.

Note The <object> tag is also used for Java applets, image files, and multimedia objects, which will also be

blocked by the new command.

If the <object> or </object> HTML tags split across network packets or if the code in the tags is longer

than the number of bytes in the MTU, PIX

Firewall cannot block the tag.

Java and ActiveX filtering of HTML files are performed by selectively replacing the <APPLET> and

</APPLET> and <OBJECT CLASSID> and </OBJECT> tags with comments. Filtering of nested tags

is supported by converting top-level tags to comments.

Note ActiveX blocking does not occur when users access an IP address referenced by the alias command.

1 2 ... 138 139 140 141 142 143 144 145 146 147 148 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 143