Configuring a Cisco IOS Router > Cisco IOS startup configuration

Cisco IOS startup configuration

Applies to

Web Filter v7.6

Web Security v7.6

Startup configuration

Before Websense software can filter Internet requests, the Cisco IOS router must be configured to use Filtering Service as a URL filter.

1.	Access the router's software from a console, or from a remote terminal using telnet.

2.	Enter your password.

3.	Enter enable and the enable password to put the router into enabled mode.

4.	Enter configure terminal to activate configure mode.

5.	Enter the following command to identify the Filtering Service machine that will filter HTTP requests:

ip urlfilter server vendor websense <ip-address>
[port <port-number>] [timeout <seconds>]
[retransmit <number>]

 

Variable	Description
<ip-address>	The IP address of the machine running Websense Filtering Service.
<port-number>	The Filtering Service port (also referred to as the integration communication port), default 15868.
<seconds>	The amount of time the Cisco IOS router waits for a response from Filtering Service. The default timeout is 5 seconds.
<number>	How many times the Cisco IOS router retransmits an HTTP request when there is no response from Filtering Service. The default is 2.

An example of this command is:

ip urlfilter server vendor websense 12.203.9.116 timeout 8 retransmit 6

To define an additional Filtering Service instance as a backup, repeat the command using the IP address of the second Filtering Service machine.

The configuration settings you create in the following steps are always applied to the primary server.

Only one Filtering Service instance is used at a time—referred to as the primary server; all other instances are referred to as secondary. If the primary server becomes unavailable, one of the secondary servers is designated primary. The system goes to the beginning of the list of configured servers (i.e. Filtering Service instances) and attempts to activate the first one. If the first server is not available, the system attempts to activate the next one. This continues until an available server is found or the end of the list of configured servers is reached. If all servers are down, the router goes into allow mode.

6.	Enable the logging of system messages to Filtering Service by entering the following command:

ip urlfilter urlf-server-log

This setting is disabled by default. When logging is enabled, the Cisco IOS router sends a log request immediately after the URL lookup request.

7.	Tell the Cisco IOS router how to filter URL requests by entering the following commands, in sequence:

ip inspect name <inspection–name> http urlfilter

interface <type> <slot/port>

ip inspect <inspection-name> {in|out}

Examples of these commands are:

ip inspect name fw_url http urlfilter

interface FastEthernet 0/0

ip inspect fw_url in

For this sequence to function properly, you must create an inspection rule called fw_url and apply that rule to the inbound interface of the router.

See Cisco documentation for information about creating and applying inspection rules.

To improve performance, Cisco suggests disabling the Java applet scanner. Java applet scanning increases CPU processing load. To disable the Java applet scanner, use the following commands, in sequence:

access-list <num> permit any

ip inspect name <inspection–name> http java-list <num> urlfilter

See Cisco documentation for more information about these commands.

8.	To save your changes:

a.	Enter the exit command twice to leave the configure mode.

b.	Enter write memory.

These commands store the configuration settings in the Cisco IOS router's startup configuration so they are not lost if the router is shut down or loses power.

9.	Use the following commands to view various aspects of your installations:

 

Command	Action
show ip inspect name <inspection-name>	Displays a specific inspection rule.
show ip inspect all	Displays all available inspection information.
show ip urlfilter config	Displays all URL filtering information.
<command-name> ?	Displays help on individual commands. For example, ip inspect ? displays the complete syntax for the inspect command, and explains each argument.

10.	To discontinue filtering or to change a Filtering Service, enter the following command to remove a server configured in Step 5.

no ip urlfilter server vendor websense <ip-address>

Configuring a Cisco IOS Router > Cisco IOS startup configuration