I'm aware that you can use the ASA's URL filtering to filter URLs being accessed with regular expressions, but I'm curious if there is a way to filter which URLs can be accessed from the Internet to an internal webserver if the traffic is encrypted.
We will want to be able to limit connections to our WepSphere server to specific URL requests. ie: www.websphereyl.com/lawson/myfile and not www.websphereyl.com/lawson/yourfiles etc…
An example scenario would be someone hits our websphere server from the Internet, which has NAT/PAT setup on the ASA to allow it access via TCP port 443. Could we restrict the URLs that can be accessed with the ASA? I'm thinking that URL filtering will not work because it's SSL traffic, but wanted to see what you guys thought.
Best Answer
You are correct, if all the ASA sees is an HTTPS request, then the TCP payload is encrypted, which prevents the ASA's URL filtering (or any other TCP payload inspection).
Typically, url filtering is done by an http reverse-proxy or load-balancer (like Cisco's ACE/CSM, F5 LTM, or Citrix Netscaler to name a few). The devices I mentioned can also offload SSL encryption from your web server pool as well.
Offloading SSL before you perform payload scrubbing / inspection has some significant advantages. By off-loading your encryption at a load-balancer, the IDS / IPS / Firewall can also see the raw HTTP traffic, which means it can spot application-layer attacks and it generally gives you better protection, if that's a priority.