Our office network uses the 1921/K9 router along with SG300 L3 switch (and a few other L2 switches) all with base modules. If we wanted to block employees from visiting certain websites, what would be the best way to do it with the current equipment?
A poor man's filter can be implemented by using NBAR to match the URL you want to block and then drop the traffic that matches.
For instance if you wanted to block google you could use the following
class-map match-any BlockGoogle match protocol http url *.google.* policy-map BlockGoogle class BlockGoogle drop interface gig 0/1 description WAN Interface ip address 22.214.171.124 255.255.255.252 service-policy output BlockGoogle
Because this is a match-any class map you can just add more URLs to match in the class.
Note: Matching based on URL will need to be done in the 1921, not the L2/3 switch.
Work with your Cisco Partner or Cisco SE on the use for ScanSafe solution integrated in IOS:
In my experience what I've done is this:
1) Setup a SPAN session on the L3 Switch and send the traffic to a destination port that will do the monitoring. 2) Configure Websense to monitor website traffic by setting up policies for what is and is not allowed.
I know that is probably not exactly what you are looking for, but that is the basics in a nutshell. Just having a Router and L3 switch doesn't allow you to monitor/block website traffic. There are other products out there besides Websense such as Dansguardian that will do the trick but Websense is probably by far the easiest to set up but also one of the most expensive in terms of licensing and hardware requirements.
What you also have to take into consideration when monitoring website traffic is the size of your network. If you are monitoring 200+ clients, I would not recommend anything less than a Quad Core Xeon box with Dual Gigabit Link and 8GB of RAM at the very minimum. Sizing is very important when deciding to monitor traffic as the box that monitors could potentially choke outbound traffic enough to where higher-ups decide to yank the box out of the network for you.
That's been my experience with monitoring website traffic, what are your thoughts?
Another alternative is to block the URLs, similar in concept to the HOSTS file, at the DNS server (assuming you're running your own DNS server).
For example, if IOS is running the DNS server, you can add:
Router(config)# ip host facebook.com 127.0.0.1
Or you could replace 127.0.0.1 with the IP of perhaps a simple web server with a static page listing which sites are forbidden and why.