Blocking facebook and myspace with a Cisco PIX

Here at work we have problems with what I'll call non-productive distractions. Usually this means someone has been surfing all day on their facebook or myspace when they should actually be doing something productive such as work. I searched all over google and have rounded up some quick and easy answers for you. Here are the commands you need to block facebook and myspace with your Cisco PIX device through an access-list.

We'll name this access-list block

#Myspace
access-list block deny tcp any 216.178.32.0 255.255.240.0

#Facebook
access-list block deny tcp any 69.63.176.0 255.255.240.0
access-list block deny tcp any 66.220.144.0 255.255.240.0
access-list block deny tcp any 69.171.224.0 255.255.224.0
access-list block deny tcp any 204.15.20.0 255.255.252.0

#essential
access-list block permit udp any any
access-list block permit tcp any any
access-list block permit icmp any any

#When you're ready to apply the access-list
access-group block in interface inside

Enter in all of the lines that aren't commented (#) out and it should cut down most of the normal computer users. They will be able to get around this with proxies, but if you want to completely cut out facebook access to people who are really good at finding proxies, you'll have to purchase some better content protection software.

You will have to modify this to your uses. Some people want to restrict pinging, in which case you'd remove the permit icmp any any command. The three permits are crucial, and without them you will end up blocking everyone on the inside to anything on the outside. What we've done is blocked just a few things, and then allowed everything else but what we've blocked in. If you add more blocks, you need to make sure they come before the permits or else they won't be taken into effect.

If you're like me and want to take things a step further to see what your users have been up to, you can do a number of things with free open source software. Here is the suite that I use at my workplace.

Gentoo Linux Software
Snort - Intrusion Detection System
BASE - Web interface for snort

Cacti - Can measure various smtp figures from computers and apply them to a graph

Ntop - Very easy program to install that shows you almost everything you want to know about your network. It even shows you what websites each specific inside host is connected to.

I also have the cisco pix 501 that I'm using send its log data to my linux box utilizing syslog-ng. I e-mail the logs from the cisco box (ranging from access-list denials to critical malfunctions) to my linux box. This lets me keep on top of what's going on with our central router.

I use this all on an old p4 dell box with 2gig of memory. I run an ethernet cable to a managed switch that can mirror all data to the port that linux is connected to. This means that I mirror the port that's hooked up to my router and gives me access to all of the data before it goes to the outside world.

If you have any questions feel free to comment or send me an e-mail at JamesArhy@gmail.com