URL monitoring on a Cisco ASA

[niloc]

Hi All

 

Does anyone know how to setup an ASA 5505 with URL logging?

[geekshelp]

Don't know about a 5505, but I have a 5520 with what I call a poor-man's URL monitor setup. I enabled the HTTP inspect command and setup syslogging. The syslog output shows the url of all computers when accessing the internet. I wrote a custom vbscript to parse the daily log looking for keywords like porn, bomb, etc. It doesn't catch everybody but it keeps the honest people honest.

[jasterad]

How do you go into the device to turn on the Http Inspect? We also have the ASA 5505. Either a CLI or an ASDM is fine. I am trying to do the same thing where we check the URL's that workers are going to, and in this case we are trying to look at a specific computer, so any additional tips about how to narrow the results once it is configured are appreciated as well.

 

Thank you

[geekshelp]

I'll have to look at the configuration again but at the end you can inspect traffic to make sure it's legit. We inspect FTP http icmp I believe.

[geekshelp]

Enable

Config t

policy-map global-policy

class inspection_default

inspect http