The ASA firewall configures URL filtering. Detailed experimental steps

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/4C/9D/wKioL1RBFBrBKfS7AAD6ZFk9emY518.jpg "title=" FFF. PNG "alt=" Wkiol1rbfbrbkfs7aad6zfk9emy518.jpg "/>

Experimental topology diagram .... Server ip:202.168.1.10

Web www.cisco.com

Www.kkgame.com are built on the server with different hostname

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/4C/9D/wKioL1RBFLOS_83kAAOIl7aKaag938.jpg "title=" Capture 1. PNG "alt=" Wkiol1rbflos_83kaaoil7akaag938.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/4C/9D/wKioL1RBFWXykNZTAALJsPumMoo671.jpg "title=" A.png " alt= "Wkiol1rbfwxyknztaaljspummoo671.jpg"/>

Permissions are added to everyone: Because you want to publish the site out.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/4C/9C/wKiom1RBFXiATU8GAAOHAlSnFd8133.jpg "title=" 2.PNG " alt= "Wkiom1rbfxiatu8gaaohalsnfd8133.jpg"/>

Add a default document of your own name, and move up to the top level if you don't have a name changed.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/4C/9D/wKioL1RBFgXhHqr_AAH2jr3RD1I186.jpg "title=" S.png " alt= "Wkiol1rbfgxhhqr_aah2jr3rd1i186.jpg"/>

A computer with 4G memory can only open two virtual machines. So DNS is also on this server.

The DNS server address is also: 202.168.1.10

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/4C/9C/wKiom1RBFfbhVjD3AAJr8DjTJGs963.jpg "title=" SS. PNG "alt=" Wkiom1rbffbhvjd3aajr8djtjgs963.jpg "/>

After the DNS settings are complete, test it with Nslookup in this machine 、、、、

Then configure the client:

Client DNS pointing to the server

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/4C/9D/wKioL1RBFoaTjUwsAAQkb5Bz-Sw751.jpg "title=" capture. PNG "alt=" Wkiol1rbfoatjuwsaaqkb5bz-sw751.jpg "/>

After you configure the basic command for the ASA, the ping package is not returned. But visiting the website is no problem. Because ICMP is stateless. The ASA is not logged.

HTTP high to low OK.

Client.. Test success:

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/4C/9D/wKioL1RBFxyiTrT7AAJDZ-9s4a8892.jpg "style=" float: none; "title=" 12.PNG "alt=" Wkiol1rbfxyitrt7aajdz-9s4a8892.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/4C/9C/wKiom1RBFubgt8FPAAK8pB1W39I333.jpg "style=" float: none; "Title=" captures ff. PNG "alt=" Wkiom1rbfubgt8fpaak8pb1w39i333.jpg "/>

Then configure URL filtering on the ASA:

Specific steps and explanations:

Asa:

Config T

Access-list tcp_filter Permit tcp 192.168.1.0 255.255.255.0 any eq www

Locate the source to reach any website traffic. Unable to locate accurately

Class-map Tcp_filter_class

Match Access-list Tcp_filter

/Match the class map of the source to reach all the web traffic

Exit

Class-map type Inspect HTTP Http_url_class

/definition Detection Class Http_url_class HTTP traffic that matches URLs in HTTP headers that do not contain Url_class class expressions

Match not request header host Regex class Url_class

The whitelist mechanism not request indicates that mismatches will be discarded and not represented by the blacklist, and the match will be dropped

Exit

Regex url1 "\.cisco\.com"

Match the regular expression match URL in the URL address (URL list) that carries the. cisco.com.

Class-map type regex match-any Url_class

Creates a collection of URLs. Multiple URL lists can be placed inside

Match Regex URL1

Exit

Policy-map type Inspect HTTP http_url_policy

Class Http_url_class

Drop-connection Log

Defines the rule detection class. Make the appropriate action to match or match the previous process

(drop)

Exit

Exit

Policy-map Inside_http_url_policy

Class Tcp_filter_class

Inspect HTTP Http_url_policy

Define Policy-map Inside_http_url_policy, define the results of the above rules and traffic detection into a policy container (POLICY-MAP)

Exit

Exit

Service-policy Inside_http_url_policy interface Inside

Apply the Policy-map to the interface to make it effective.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/4C/9D/wKioL1RBF4TQz9aoAAJDZ-9s4a8794.jpg "style=" float: none; "title=" 12.PNG "alt=" Wkiol1rbf4tqz9aoaajdz-9s4a8794.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/4C/9C/wKiom1RBF0-AP1_cAAOQDXMpC-Q730.jpg "style=" float: none; "title=" 123.PNG "alt=" Wkiom1rbf0-ap1_caaoqdxmpc-q730.jpg "/>

All right.. Our experiment was done ... may not be very comprehensive ...

This article from the "heartbroken people in the Tianya" blog, declined reproduced!

The ASA firewall configures URL filtering. Detailed experimental steps