Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to US CERT TA13-010A, all computer users are advised to disable Java 1.7 in their browser due to arbitrary code execution risks from a zero-day Java vulnerability; however, we rely on internal Java apps for our business-critical services.

How can we protect corporate network from external malicious threats, while still permitting our internal Java apps to function? Preferably, we would like to disable Java through our Cisco ASA firewall...

share|improve this question
up vote 1 down vote accepted

We decided to use the ASA's filter java command, which blocks all (non-SSL) java applications sent to our internal network block ( on any port (1-65535).

filter java 1-65535

While we would love to block Java delivered via SSL, this measure seems to be the most reasonable tradeoff, since we can't afford to completely disable Java and tank our internal apps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.