Asa-url-filter

Requirements

hosts with IP address ranges in 192.168.0.1-192.168.0.15 can only access www.163.com, you cannot access any other websites.

prohibit all hosts from accessing www.kkgame.com.  

implement URL filtering into 3 steps

Create class-map(class-map) to identify transport traffic

Create policy-map(Policy map), associate class-map

apply policy-map to the interface

 

ip www.163.com

You cannot access any other Web site.

1 , create class-map to identify the transmission traffic

asa802 (config) # access-list tcp_filter permit tcp 192.168.0.0255.255.255.240 any eq www

asa802 (config) # Class-map Tcp_filter_class

asa802 (config-cmap) # match access-list Tcp_filter  

asa802 (Config-cmap) #exit

asa802 (config) # regex url1 "\.163\.com"

asa802 (config) # class-map type regex match-any url_class ( Create a class of type "regex")

asa802 (Config-cmap) # match regex URL1

asa802 (config-cmap) # exit  

( Create a class with type "Inspect"and check Protocol as http )

asa802 (config) # class-map type inspect HTTP http_url_class

http url_class

asa802 (CONFIG-CMAP) # Match not request header host Regex class Url_class

asa802 (config-cmap) # exit  

2. Create policy-map, associate class-map

(Create check http policy for message traffic)

asa802 (config) # policy-map type inspect HTTP http_url_policy

asa802 (CONFIG-PMAP) # class Http_url_class

asa802 (config-pmap-c) # drop-connection Log

asa802 (config-pmap-c) # exit

asa802 (config-pmap) #exit  

(Create interface App policy)

asa802 (config) # Policy-map Inside_http_url_policy

asa802 (CONFIG-PMAP) # class Tcp_filter_class

asa802 (config-pmap-c) # Inspect HTTP Http_url_policy

asa802 (config-pmap-c) # exit

asa802 (Config-pmap) #exit

3 , Application policy-map to the interface

asa802 (config) #service-policy Inside_http_url_policy interface inside

4. Validation

a) PC1 can access www.163.com

b)         PC1 No access to  

task Two, prohibit all host access www.kkgame.com .  

1. Create class-mapto identify transport traffic

asa802 (config) # access-list tcp_filter2 permit tcp any any EQ www

asa802 (config) # Class-map Tcp_filter_class2

asa802 (config-cmap) # match Access-list Tcp_filter2

asa802 (Config-cmap) #exit

asa802 (config) # regex url2 "\.kkgame\.com"

asa802 (config) # class-map type regex match-any url_class2

asa802 (Config-cmap) # match regex Url2

asa802 (Config-cmap) # exit

asa802 (config) # class-map type inspect HTTP http_url_class2

asa802 (config-cmap) # Match request Header host Regex Classurl_class2      

asa802 (Config-cmap) # exit

2 , creating Policy-map , association Class-map

asa802 (config) # policy-map type inspect HTTP http_url_policy2

asa802 (CONFIG-PMAP) # class Http_url_class2

asa802 (config-pmap-c) # drop-connection Log   

asa802 (config-pmap-c) # exit

asa802 (Config-pmap) #exit

asa802 (config) # Policy-map Inside_http_url_policy         

asa802 (CONFIG-PMAP) # class Tcp_filter_class2

asa802 (config-pmap-c) # Inspect HTTP http_url_policy2

asa802 (config-pmap-c) # exit

asa802 (Config-pmap) #exit

3 , Application policy-map to the interface

asa802 (config) #service-policy Inside_http_url_policy interface inside

4 , verify

will be PC1 the IP Change to 192.168.0.20 , you cannot access the www.kkgame.com .  

Tips:

acl

If you increase URL , you need to define a new regular expression (that is, regexurl2 ), and add to class-map Medium (match-any )

This article from "Liu Xiao Rabbit" blog, declined reprint!

Asa-url-filter