Verify your web filtering configuration

If your web filtering implementation has the service set to Cisco Umbrella, or if it is configured to use manual DNS servers and uses the Cisco open DNS servers, you can verify the web filtering implementation by using the Cisco test site www.internetbadguys.com.

To verify the implementation:


This procedure assumes you have already configured web filtering to use either Cisco Umbrella or the Cisco open DNS servers.

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Disable web filtering:
    1. Click Firewall > Web filtering service.
    2. Click Enable web filtering to disable.

    3. Click Apply to save the configuration and apply the change.
  4. From a new tab in your browser, attempt to connect to the Cisco test URL http://www.internetbadguys.com.

    The connection should be successful.

  5. Return to the IX20 WebUI and enable web filtering:
    1. Click Firewall > Web filtering service.
    2. Click Enable web filtering to enable.
    3. Click Apply to save the configuration and apply the change.
  6. From your browser, attempt to connect to http://www.internetbadguys.com again.

    The connection attempt should fail with the message, "This site is blocked due to a phishing threat."

This procedure assumes you have already configured web filtering to use either Cisco Umbrella or the Cisco open DNS servers.

  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX20 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. Disable web filtering:
    > config firewall web-filter enable false
>
  3. Attempt to connect to the Cisco test URL http://www.internetbadguys.com by using either a web browser or the curl command from a Linux shell:
    $ curl -I http://www.internetbadguys.com
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html; charset=UTF-8
Accept-Ranges: bytes
Date: Thu, Jan 11, 2024 12:10:00
X-Varnish: 4201397492
Age: 0
Via: 1.1 varnish
Connection: keep-alive

$

    You should receive an "HTTP/1.1 200 OK" message, as highlighted above.

  4. Return to the Admin CLI and enable web filtering:
    > config firewall web-filter enable true
>
  5. Attempt to connect to http://www.internetbadguys.com again:
    $ curl -I www.internetbadguys.com
HTTP/1.1 403 Forbidden
Server: openresty/1.9.7.3
Date: Thu, Jan 11, 2024 12:10:00
Content-Type: text/html
Connection: keep-alive

$

    You should receive an "HTTP/1.1 403 Forbidden" message, as highlighted above.