Application Layer filtering

[Bluecrack]

I have tcp port 80 open for outbund connections so users at my company can browse the web. However, I have some users who are redirecting SSH (and other traffic) over port 80 to connect to say their home computers. Is there a way to configure the PIX to allow only HTTP traffic only port 80 and block anything that is not legimiate HTTP traffic?

FYI - I'm running PIX version 6.01.

Bluecrack

 

[webnetwiz]

I believe you can do an access list that would say something like

access-list 101 permit whatever whatever http

The keyword here is http.

I'm not sure about this though.

David K.

 

[dchp]

No, http will just resolve to port 80. Are you running fixup on port 80? It should be on by default. Basically the pix will not filter at the application level. What you could do is install a proxy, and only allow 80 out from that server.