Downloads |
Q. What is Cisco IOS® Content Filtering?
A. Cisco IOS Content Filtering protects your WAN links and critical network infrastructure from web-based threats. It is a subscription-based service that allows network administrators to create router policies that limit Internet access based on Website categories (such as violence or pornography) or security ratings for sites that are known to dispense malicious content.
Q. What are the benefits of using Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering helps organizations improve employee productivity and protect users from malware, adware, spyware, and phishing.
Q. Who is best suited to take advantage of Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is ideal for retail locations, small and medium-sized businesses, enterprise branch offices, and schools.
Solution Details
Q. What is the difference between the URL Filtering feature in Cisco IOS Software, and the new Cisco IOS Content Filtering?
A. Cisco IOS URL Filtering feature supports only static black and white lists, and off-box support for Websense and Smartfilter. The subscription-based Cisco IOS Content Filtering service adds security rating and category blocking to static black and white lists, and keyword blocking starting from Cisco IOS Software Release 12.4(15)XZ.
Q. Can Cisco IOS Content Filtering be configured with other security features?
A. Yes. All other security features, such as VPN, firewall, and intrusion prevention, can be configured with Cisco IOS Content Filtering.
Q. Why do I need content filtering if I already have a firewall?
A. A firewall is designed to allow or block Internet traffic. Cisco IOS Content Filtering provides protection from malicious Websites and enables organizations to address compliance requirements and enforce a consistent Web security policy.
Q. Can Cisco IOS Firewall and Cisco IOS Content Filtering be turned on together?
A. Yes. Cisco IOS Firewall and Cisco IOS Content Filtering can be turned on together on the same interface, as long as the new subscription-based Cisco IOS Content Filtering is used with Zone-Based Cisco IOS Firewall introduced in 12.4(6)T (not context-based access control [CBAC]).
Q. What is the role of Trend Micro in Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering uses Trend Micro's Rating Server and research conducted by Trend Micro's TrendLabs™. Trend Micro's URL database contains millions of URLs in more than 70 categories, including productivity and security categories. Trend Micro's TrendLabs™ conducts research on millions of Websites and updates the database regularly
Q. What are categories?
A. Most types of Websites that are frequently surfed are put into categories (such as gaming, pornography, weapons, or stock trading). Trend Micro's database contains URLs in each of these categories. Cisco IOS Content Filtering has more than 70 categories to select from.
Q. List the 70 Productivity Categories supported by Trend Micro?
A. Here's the list of all the 70 Productivity categories:
Q. What is a reputation security rating?
A. In this context, a security rating is a rating given by Trend Micro's TrendLabs to a URL based on a combination of a URL's past behavior and current exposure to malware, adware, phishing, spyware, and hacking.
Q. List all the Security categories supported by Trend Micro?
A. Here's the list of all the 10 security categories supported:
Q. Are Websense and SmartFilter still supported?
A. Yes. Cisco IOS Content Filtering still supports Websense and SmartFilter.
Q. How is Cisco IOS Content Filtering configured?
A. Cisco IOS Content Filtering can be configured using Cisco Configuration Professional 1.1 or a command-line interface. Please refer to the configuration guide at http://www.cisco.com/go/ioscontentfiltering for more details.
Q. What are my management options for Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering can be configured using Cisco Configuration Professional. CCP 1.1 can be downloaded at http://www.cisco.com/go/ciscocp.
Also, Cisco Security Manager 3.3 supports IOS Content Filtering.
Q. What platforms support Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is supported on the following platforms:
• Cisco 800 Series
• Cisco 1800 Series
• Cisco 1900 Series
• Cisco 2800 Series
• Cisco 2900 Series
• Cisco 3800 Series
• Cisco 3900 Series
Q. What feature sets support Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is supported on the Advanced IP Services image in the Cisco 800 series and Advanced Security image and higher on Cisco 1800, 2800, and 3800 series platforms.
Q. What is the performance impact?
A. Since the categories and their respective decisions (permit or deny) are cached, the router need not reference the database each time a web page is requested. Therefore there is minimal performance impact when pages are accessed for the first time and there is no impact for cached pages.
Q. Do I need additional memory to turn on Cisco IOS Content Filtering?
A. No. Standard memory that comes with the ISRs is sufficient.
Q. Do "ip inspect" commands work with Cisco IOS Content Filtering?
A. No. "ip inspect" commands do not work with Cisco IOS Content Filtering.
Licensing
Q. How is licensing handled?
A. Unlike many Content Filtering solutions, Cisco IOS Content Filtering does not require a per-user license. It is based on purchasing a 1 year subscription service associated with your router platform. A 30-day trial license is also available. SL-CNFIL-8xx-TRI, SL-CNFIL-1xxx-TRI, SL-CNFIL-2xxx-TRI, and SL-CNFIL-3xxx-TRI are the SKUs for the 30 day license.
Q. How do I order trial license and when does the trial period start? What do I do when my trial period expires?
A. You can order the trial license through the Cisco demo license website at http://www.cisco.com/go/license. At this website, please enter your router Serial number and router type. A 30 day trial license will get activated the day you enter your router credentials on the site. For IOS Content Filtering to work, you would have to download a certificate from http://www.cisco.com/en/US/products/ps5854/products_configuration_example09186a0080816c23.shtml and then configure IOS Content Filtering on the router.
Once the 30 day trial period is over, you can purchase a subscription service for IOS Content Filtering. Subscription service
Q. What happens if I misplace my activation code?
A. Please call Cisco TAC in case you misplace your activation code.
Q. What happens if my license expires before a renewal can be completed?
A. Once a license expires, you are provided with a 30-day grace period, during which you continue to receive all the benefits of active licenses. After the 30-day grace period, the product will cease to retrieve any updates and the Content filtering functionality will allow all URLs unfiltered, unless they are part of the static black and white lists, or blocked keywords.
Ordering
Q. What IOS images support Cisco IOS Content Filtering?
A. Cisco IOS Content Filtering is available in the Advanced IP Services image on the Cisco 800 series routers. For the rest of the ISRs, Advanced Security image or higher is needed. A 1 year license is required to enable the service. For the next-generation of Integrated Services Routers, the security package supports IOS Content Filtering.
Q. How do I purchase my IOS Content Filtering license?
A. Please work with your Cisco partner to purchase a software subscription license for IOS Content Filtering. You will receive a PAK (product activation key) when order is fulfilled. Then you can register it on the licensing portal http://www.cisco.com/go/license.
Once registered, the subscription period begins. Configure the router appropriately and start benefitting from the service. For more configuration details, please visit http://www.cisco.com/go/ioscontentfiltering.
Q. What are the SKUs for Cisco IOS Content Filtering?
A. The following SKUs are supported:
• SL-CNFIL-88x-1Y
• SL-CNFIL-87x-1Y
• SL-CNFIL-180X-1Y
• SL-CNFIL-181X-1Y
• SL-CNFIL-184-1Y
• SL-CNFIL-186-1Y
• SL-CNFIL-280-1Y
• SL-CNFIL-281-1Y
• SL-CNFIL-282-1Y
• SL-CNFIL-285-1Y
• SL-CNFIL-382-1Y
• SL-CNFIL-384-1Y
Q. Do I purchase the subscription service directly from Trend Micro?
A. No. The subscription service as well as renewals are purchased from Cisco.
Q. How do I renew my subscriptions?
A. You should purchase software subscription service license for Cisco IOS Content Filtering through your Cisco partner as you are nearing completion of the existing subscription. The router will send reminders to the console 30 days prior to the subscription expiration.
The renewal process is much like a new license purchase process: you will receive a PAK when the renewal order is fulfilled. When you register it, the product will be renewed seamlessly. You do not need a new activation code to renew the subscription.
Technical Support
Q. Is the Cisco IOS Content Filtering service included in Cisco SMARTnet® support?
A. No. The Cisco IOS Content Filtering subscription service is separate from Cisco SMARTnet. However, Cisco SMARTnet is also required in conjunction with a Cisco IOS Content Filtering subscription. Cisco SMARTnet provides you with access to the Cisco Technical Assistance Center (TAC) and Cisco IOS software updates.
Q. I have a subscription service from Trend Micro for my Cisco router. Do I need to go to them for support?
A. No, call Cisco TAC for all support questions.
Q. How do I rehost the Cisco IOS Content Filtering subscription?
A. Please call Cisco TAC for rehosting subscription service from one router to another.
Q. Where can I learn more about Cisco SMARTnet Services?
General Information
Q. Where is the Trend Micro URL database located?
A. Trend Micro's databases are strategically located to support users around the world with built-in redundancy for high availability.
Q. How does Cisco IOS Content Filtering differ from the Content Security and Control module for the ASA platform?
A. Cisco IOS Content Filtering is a subscription based service for Cisco ISRs that provide protection from malicious websites as well as improve employee productivity using URL filtering techniques. The Cisco Content Security and Control (CSC-SSM) module is an expansion card for the Cisco ASA 5500 Series of security appliances that scans Web, e-mail, and ftp traffic to stop content-based threats, including phishing, spyware, spam, and viruses. The CSC-SSM also controls unwanted mail and Web content. Both products use technology from Trend Micro.
Q. How can I learn more about Cisco IOS Content Filtering?
A. Please visit http://www.cisco.com/go/ioscontentfiltering for more information or contact your local Cisco sales team.
Cisco Recommendations for IOS Content Filtering
Q. What is the recommended order of configuration for Content Filtering?
A. Cisco recommends the following order to configure IOS Content Filtering:
1. Black Lists
2. White Lists
3. Keywords to block
4. Security Rating Categories
5. Prodcutivity Categories
Q. What is Cisco's recommendation on Security Rating Categories?
A. Cisco recommends turning on all the Security Rating Categories except for the UNBLEMISHED category.