Pointless Security Option on MX Appliances?

BlakeRichardson
Kind of a big deal
Kind of a big deal

Pointless Security Option on MX Appliances?

Screen Shot 2018-02-26 at 9.49.46 AM.png

 

I have seen this option before but never both to set it on anything apart from full list and never really thought about it. I decided to find out what the "top sites" option meant and to be honest I found it rather worrying and pointless, the description for it is below.

 

Screen Shot 2018-02-26 at 9.49.39 AM.png

 

The Bit that worries me is the line "client requests for URLs that are not i nthe top sites list will always be permitted"  Does that mean a user could pick a porn site thats not a popular one and still be able to access it? 

 

This feature seems redundant as most people are just going to select full list. As a network admin that answers to the CEO I cannot take the risk of not knowing what sites the "top sites" option will or will not block....

 

 

3 Replies 3
Adam
Kind of a big deal

To answer your question, Yes.  A non popular porn, torrent etc will not be capture in the Top Site content filter.  

 

Top sites is high performance but only truly covers some of the most popular websites.  If you want actual coverage then you need to use the Full Site list.  Only time I've had to go from Full to Top is if my MX is at the high end of the users it is designed for and having performance issues. 

Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO
If this was helpful click the Kudo button below
If my reply solved your issue, please mark it as a solution.

@Adam I understand how it works but it seems pointless. What is the point of content filtering if it only does a small amount of the job.

 

 

I wouldn't say it's pointless, it's just about flexibility really.  But I get what you mean.  If an MX is already heavily loaded or in need of upgrade, it's about giving an option with less performance impact (less impact on the MX itself and less impact on the cloud lookup service).  And I wouldn't say top sites is doing a SMALL number of just the most common sites, it typically blocks the good majority of the common sites for a given category.  Naturally the less popular one-off sites will be allowed through, but it's less common, and of course you've got blacklisting, and don't forget you can turn on Syslog and capture every URL being hit. It's definitely a "your mileage will vary" type of thing.

 

Full list is obviously more intensive, and if there's lots of categories turned on, along with other advanced security features, there's more of a performance hit.  Top sites works pretty well in many cases, but of course it depends on the deployment and user base, and if there are any legal or liability concerns.  And in that case, size the MX appropriately and go Full List.  While it may be a bit more cumbersome, I do have many customers who leverage top sites plus blacklisting and URL syslogging.  

 

Also consider, this feature has been around from the very beginning, and I'm not saying it's deprecated, but several years ago it was a much bigger deal than it is today forcing so many full-list URL look-ups to the cloud over slower ISP links.  Likely not as big a deal now as it might have been a few years ago.

 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels