5

I'm aware that you can use the ASA's URL filtering to filter URLs being accessed with regular expressions, but I'm curious if there is a way to filter which URLs can be accessed from the Internet to an internal webserver if the traffic is encrypted.

We will want to be able to limit connections to our WepSphere server to specific URL requests. ie: www.websphereyl.com/lawson/myfile and not www.websphereyl.com/lawson/yourfiles etc...

An example scenario would be someone hits our websphere server from the Internet, which has NAT/PAT setup on the ASA to allow it access via TCP port 443. Could we restrict the URLs that can be accessed with the ASA? I'm thinking that URL filtering will not work because it's SSL traffic, but wanted to see what you guys thought.

  • This is a job for web server security. The ASA cannot do anything based on encrypted contents it cannot see. – Ricky Beam Dec 31 '13 at 23:00
7

You are correct, if all the ASA sees is an HTTPS request, then the TCP payload is encrypted, which prevents the ASA's URL filtering (or any other TCP payload inspection).

Typically, url filtering is done by an http reverse-proxy or load-balancer (like Cisco's ACE/CSM, F5 LTM, or Citrix Netscaler to name a few). The devices I mentioned can also offload SSL encryption from your web server pool as well.

Offloading SSL before you perform payload scrubbing / inspection has some significant advantages. By off-loading your encryption at a load-balancer, the IDS / IPS / Firewall can also see the raw HTTP traffic, which means it can spot application-layer attacks and it generally gives you better protection, if that's a priority.

  • 2
    also, ssl accelerators can be used to protect one's ssl keys. I know a lot of banks that do that. (with FIPS certified accelerators.) – Ricky Beam Dec 31 '13 at 23:03
  • Ricky, I believe that I understand what you mean, but for the benefit of those afterwards... you're thinking of a situation where the web application server is compromised. If SSL is performed by individual webhosts, one rooted webhost exposes the SSL secrets for the whole domain; however, a rooted webhost is no risk to the domain's SSL keys if an upstream load-balancer off-loads SSL. By having a dedicated appliance take care of the heavy-lifting (SSL, HTTP compression, etc) the webhosts are safer. – Mike Pennington Dec 31 '13 at 23:08
  • tcp intercept proxies SSL right? – John Kennedy Jan 2 '14 at 16:25
  • @JohnKennedy, could you elaborate a bit more about tcp intercept and the point you're making? – Mike Pennington Jan 2 '14 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.