[fw-wiz] Enforcing content filtering with PIX515E

Hi all,

Apologies if this is dumb, obvious or both, but I've never had to get a
firewall to do this before. We've just signed up with SurfControl to
provide us with content filtering for our web users.
Actually getting all the various versions of various browsers on our
network to use it as their proxy server is proving problematic; each
version of IE seems to store the proxy URL in a different registry key.
Also, thanks to our IT policy (or lack thereof), there's not much we can
do to prevent users simply removing the proxy setting in their browsers
and looking at whatever sites they please.
So I thought I'd try reconfiguring our firewall to send any outgoing
traffic on port 80 to the IP/port that SurfControl gave us. The
access-list for the inside interface on the PIX currently reads:

access-list acl_in permit icmp any any
access-list acl_in permit ip any any

In other words, anything on the inside interface is allowed to access
anywhere. Am I right in thinking that to force outgoing port 80 traffic
in the direction of SurfControl, I'd need to add a line to acl_in along
these lines:

access-list acl_in permit any host 80 <surfcontrol's IP> 8081

Would this suffice, or do I need something more involved?

Thanks,
Ian.

*********************************
Ian Rarity
Technical Engineer
ESPC (UK) Ltd.



*******************************************************************
Private and Confidential: This e-mail transmission is strictly
confidential and intended solely for the addressee. It may contain
privileged and confidential information and if you are not the
intended recipient, you must not copy, disclose, distribute or
take any action in reliance on it. If you have received this
e-mail in error, please delete it and notify our E-mail Systems
Administrator on +44 (0) 131 624 8000. ESPC (UK) Ltd does not
accept any liability for any harm that may be caused to the
recipient's system or data by this message or any attachment.

ESPC (UK) Ltd is a company registered under the Companies
Acts in Scotland (Registered Number SC203535), and having its
registered office at 90A George Street, Edinburgh, Midlothian
EH2 3DF.

ESPC (UK) Limited is authorised and regulated by the Financial
Services Authority.
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: XP Firewall Disabled - Help!
    ... I want to clarify that I perform all steps in the notepad file I ... anything in the registry. ... Sony Luvy ... can cause the Windows Firewall to be disabled?? ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Continuous hard disk activity - Please help...getting crazy!
    ... I use AVG and ZoneAlarm too..;>)) ... remove MacAfee, disable XP's firewall. ... Do I have to clean the registry after that? ... Do you think Messenger could be responsible for that? ...
    (alt.sys.pc-clone.dell)
  • Re: XP SP2 - Automatic Updates
    ... that most of the users posting to them are either novices or intermediate ... even the most advanced should stay out of the registry. ... >> the firewall in XP than hacking the registry. ... Sure, laptops are the exception, but none of my workstations really ...
    (microsoft.public.windowsxp.general)
  • RE: Ensuring Disabling/Uninstalation of Windows XP Firewall in LA N enviro.
    ... Since the Group Policy editor is really just a fancy GUI for making registry ... Ensuring Disabling/Uninstalation of Windows XP Firewall in LAN ... Since this is not an AD environment as yet, ...
    (Focus-Microsoft)
  • Re: Group Policy is preventing me from turning on Windows Firewall
    ... Most likely some malware or spyware has configured such via a registry mod ... Group Policy that will reverse what the registry ... The registry keys to add to disable Windows Firewall for both the domain and ... I went into the settings to ...
    (microsoft.public.windowsxp.security_admin)