Cisco 500 Series, Configuration Manual

Page: 385 / 1140

20-9
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 20 Applying Filtering Services
Viewing Filtering Statistics and Configuration
Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server or subnetwork
responding to requests.
The allow option causes the security appliance to forward HTTPS traffic without filtering when the
primary filtering server is unavailable.
Filtering FTP Requests
You must identify and enable the URL filtering server before enabling FTP filtering.
Note
Websense and Smartfilter currently support FTP; older versions of Secure Computing SmartFilter
(formerly known as N2H2) did not support FTP filtering.
When the filtering server approves an FTP connection request, the security appliance allows the
successful FTP return code to reach originating client. For example, a successful return code is “250:
CWD command successful.” If the filtering server denies the request, alters the FTP return code to show
that the connection was denied. For example, the security appliance changes code 250 to “550 Requested
file is prohibited by URL filtering policy.”
To enable FTP filtering, enter the following command:
hostname(config)# filter ftp port [ -port ] localIP local_mask foreign_IP foreign_mask
[ allow ] [ interact-block ]
Replace port [ -port ] with a range of port numbers if a different port than the default port for FTP (21) is
used.
Replace local_ip and local_mask with the IP address and subnet mask of a user or subnetwork making
requests.
Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server or subnetwork
responding to requests.
The allow option causes the security appliance to forward HTTPS traffic without filtering when the
primary filtering server is unavailable.
Use the interact-block option to prevent interactive FTP sessions that do not provide the entire directory
path. An interactive FTP client allows the user to change directories without typing the entire path. For
example, the user might enter
cd ./files instead of cd /public/files .
Viewing Filtering Statistics and Configuration
This section describes how to monitor filtering statistics. This section includes the following topics:
• Viewing Filtering Server Statistics, page 20-10
•
Viewing Buffer Configuration and Statistics, page 20-11
• Viewing Caching Statistics, page 20-11
•
Viewing Filtering Performance Statistics, page 20-11
• Viewing Filtering Configuration, page 20-12