I am network administrator in a small company. Until recently i used the Cisco ASA to prevent the employees from surfing facebook, youtube... But now they are using proxy server to overcome this. Any idea on how to prevent this ?
4
-
This questions is not really within the subject scope of this website. ASA's do support features like URL blocking though which you can use to filter access to a proxy. Also you can do things like block ports TCP 8000 and TCP 8080 outbound if your users are connecting to proxies over those common proxy ports. However simply "How to stop my users from using a proxy server" is a political question not a technical one :) If you have a more specific question though such as "How can I filter port TCP 8080 on my ASA" then I suggest you update your original post to say that. Please rephrase.– BaldrickJul 4, 2014 at 9:47
-
1What kind of proxy server are you using?– Ryan FoleyJul 4, 2014 at 10:11
-
Looking from the other side: It's always good to run an ssh daemon on port 443. Just directly connect or tunnel through the a proxy. Works for me in 99 of 100 cases and shows that blocking ports will just increase user creativity.– user2084Jul 7, 2014 at 11:02
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Jan 5, 2021 at 1:27
Add a comment
|
3 Answers
One way that won't be well-received is to provide a locked-down proxy inside your network and block all inside-out tcp/80 traffic except for that proxy. Your clients won't get web access unless they go through your proxy. If the outside proxy they're using is on some other port, you're probably covered already if you don't have the inside implicit any/any allowed rule.
Squid comes to mind as one proxy you could use.
Other considerations should go to ASA-X series firewalls with CX and possibly NBAR on your router.
answered Jul 4, 2014 at 9:05
There is a pretty simple method for doing this and it sounds like you already have most of the equipment already in place. You can also add bandwidth saving features like caching.
Squid really is the best option out there. I found a CISCO community forums post describing how to set up a route on your firewall and configure it to point to a Squid server correctly.
Using, Squid3(beta) or Squid2(stable), in transparent proxy mode you can force all client traffic that has to go through your firewall to squid and use Dansguardian(web content filter) to stop them from going to Facebook including with their phones.
I would recommend using FreeBSD or any flavor of BSD really. It is extremely optomized for tasks such as routing and the like.
Once you have transparency mode established properly you can turn on Squid's best feature: static HTTP content caching (HTTPS caching with Squid3). You can configure Squid to cache things like: images, videos, HTML files, CSS files, etc. Saves you bandwidth and reduces network chatter. You can even cache Windows updates for the whole network. Download on the initial machine and all the others are directed the the cache.
To achieve this more easily there is a networking OS called pfSense(which uses FreeBSD) that has all of this stuff in an integrated GUI. Allows you to easily install Squid2 or 3) and configure it as your network's perimeter firewall. It comes with many automatic security features like CISCO products.
Deploy explicit http proxy. Many vendors, choose based on your needs and budget. Integration with Active Directory is highly recommended, so access to various internet resources will be group based.
