Enabling Filtering Of Long Http Urls - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 20 Applying Filtering Services
When the filtering server approves an HTTP connection request, the security appliance allows the reply
from the web server to reach the originating client. If the filtering server denies the request, the security
appliance redirects the user to a block page, indicating that access was denied.
To enable HTTP filtering, enter the following command:
hostname(config)# filter url [http | port[-port] local_ip local_mask foreign_ip
foreign_mask] [allow] [proxy-block]
Replace port with one or more port numbers if a different port than the default port for HTTP (80) is
used. Replace local_ip and local_mask with the IP address and subnet mask of a user or subnetwork
making requests. Replace foreign_ip and foreign_mask with the IP address and subnet mask of a server
or subnetwork responding to requests.
The allow option causes the security appliance to forward HTTP traffic without filtering when the
primary filtering server is unavailable. Use the proxy-block command to drop all requests to proxy
servers.

Enabling Filtering of Long HTTP URLs

By default, the security appliance considers an HTTP URL to be a long URL if it is greater than 1159
characters. You can increase the maximum length allowed.
Configure the maximum size of a single URL with the following command:
hostname(config)# url-block url-size long-url-size
Replace long-url-size with the maximum size in KB for each long URL being buffered. For Websense,
this is a value from 2 to 4 for a maximum URL size of 2 KB to 4 KB; for Secure Computing, this is a
value between 2 to 3 for a maximum URL size of 2 KB to 3 KB. The default value is 2.
Truncating Long HTTP URLs
By default, if a URL exceeds the maximum permitted size, then it is dropped. To avoid this, you can set
the security appliance to truncate a long URL by entering the following command:
hostname(config)# filter url [longurl-truncate | longurl-deny | cgi-truncate]
The longurl-truncate option causes the security appliance to send only the hostname or IP address
portion of the URL for evaluation to the filtering server when the URL is longer than the maximum
length permitted. Use the longurl-deny option to deny outbound URL traffic if the URL is longer than
the maximum permitted.
Use the cgi-truncate option to truncate CGI URLs to include only the CGI script location and the script
name without any parameters. Many long HTTP requests are CGI requests. If the parameters list is very
long, waiting and sending the complete CGI request including the parameter list can use up memory
resources and affect firewall performance.
Exempting Traffic from Filtering
To exempt specific traffic from filtering, enter the following command:
hostname(config)# filter url except source_ip source_mask dest_ip dest_mask
For example, the following commands cause all HTTP requests to be forwarded to the filtering server
except for those from 10.0.2.54.
hostname(config)# filter url http 0 0 0 0
OL-10088-01
Filtering URLs and FTP Requests with an External Server
Cisco Security Appliance Command Line Configuration Guide
20-7