Asa-url-filter

Source: Internet
Author: User

Requirements

hosts with IP address ranges in 192.168.0.1-192.168.0.15 can only access www.163.com, you cannot access any other websites.

prohibit all hosts from accessing www.kkgame.com.  

implement URL filtering into 3 steps

Create class-map(class-map) to identify transport traffic

Create policy-map(Policy map), associate class-map

apply policy-map to the interface

 

ip www.163.com

You cannot access any other Web site.

1 , create class-map to identify the transmission traffic

asa802 (config) # access-list tcp_filter permit tcp 192.168.0.0255.255.255.240 any eq www

asa802 (config) # Class-map Tcp_filter_class

asa802 (config-cmap) # match access-list Tcp_filter  

asa802 (Config-cmap) #exit

asa802 (config) # regex url1 "\.163\.com"

asa802 (config) # class-map type regex match-any url_class ( Create a class of type "regex")

asa802 (Config-cmap) # match regex URL1

asa802 (config-cmap) # exit  

( Create a class with type "Inspect"and check Protocol as http )

asa802 (config) # class-map type inspect HTTP http_url_class

http url_class

asa802 (CONFIG-CMAP) # Match not request header host Regex class Url_class

asa802 (config-cmap) # exit  

2. Create policy-map, associate class-map

(Create check http policy for message traffic)

asa802 (config) # policy-map type inspect HTTP http_url_policy

asa802 (CONFIG-PMAP) # class Http_url_class

asa802 (config-pmap-c) # drop-connection Log

asa802 (config-pmap-c) # exit

asa802 (config-pmap) #exit  

(Create interface App policy)

asa802 (config) # Policy-map Inside_http_url_policy

asa802 (CONFIG-PMAP) # class Tcp_filter_class

asa802 (config-pmap-c) # Inspect HTTP Http_url_policy

asa802 (config-pmap-c) # exit

asa802 (Config-pmap) #exit

3 , Application policy-map to the interface

asa802 (config) #service-policy Inside_http_url_policy interface inside

4. Validation

a) PC1 can access www.163.com

b)         PC1 No access to  

task Two, prohibit all host access www.kkgame.com .  

1. Create class-mapto identify transport traffic

asa802 (config) # access-list tcp_filter2 permit tcp any any EQ www

asa802 (config) # Class-map Tcp_filter_class2

asa802 (config-cmap) # match Access-list Tcp_filter2

asa802 (Config-cmap) #exit

asa802 (config) # regex url2 "\.kkgame\.com"

asa802 (config) # class-map type regex match-any url_class2

asa802 (Config-cmap) # match regex Url2

asa802 (Config-cmap) # exit

asa802 (config) # class-map type inspect HTTP http_url_class2

asa802 (config-cmap) # Match request Header host Regex Classurl_class2      

asa802 (Config-cmap) # exit

2 , creating Policy-map , association Class-map

asa802 (config) # policy-map type inspect HTTP http_url_policy2

asa802 (CONFIG-PMAP) # class Http_url_class2

asa802 (config-pmap-c) # drop-connection Log   

asa802 (config-pmap-c) # exit

asa802 (Config-pmap) #exit

asa802 (config) # Policy-map Inside_http_url_policy         

asa802 (CONFIG-PMAP) # class Tcp_filter_class2

asa802 (config-pmap-c) # Inspect HTTP http_url_policy2

asa802 (config-pmap-c) # exit

asa802 (Config-pmap) #exit

3 , Application policy-map to the interface

asa802 (config) #service-policy Inside_http_url_policy interface inside

4 , verify

will be PC1 the IP Change to 192.168.0.20 , you cannot access the www.kkgame.com .  

Tips:

acl

If you increase URL , you need to define a new regular expression (that is, regexurl2 ), and add to class-map Medium (match-any )


This article from "Liu Xiao Rabbit" blog, declined reprint!

Asa-url-filter

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.