URL Blocking Cisco ASA

URL Blocking on Cisco ASA

Topology

User access will be blocked while access the urls matching on configured regular expression

ASA Configuration

!

object-group user TEST-USER

 user LOCAL\test

 user LOCAL\test1

object-group service USER-SERVICE tcp

 port-object eq www

 port-object eq https

!

access-list USER-TRAFFIC extended permit tcp object-group-user TEST-USER any any object-group USER-SERVICE

!

regex cisco.com "cisco\.com"

!

class-map type inspect http match-any CMAP-MATCH-URL

 match request header host regex cisco.com

class-map CMAP-MATCH-HTTP

 match access-list USER-TRAFFIC

!

policy-map type inspect http PMAP-MATCH-URL

 parameters

 class CMAP-MATCH-URL

  drop-connection log

policy-map PMAP-BLOCK-URL

 class CMAP-MATCH-HTTP

  inspect http PMAP-MATCH-URL

!

service-policy PMAP-BLOCK-URL interface outside

IP host entry is configured on user machine with IP of router CSR3

CSR2

!

ip host cisco.com 192.168.12.2

ip dhcp excluded-address 192.168.10.1 192.168.10.11

!

ip dhcp pool POOL1

 network 192.168.10.0 255.255.255.0

 default-router 192.168.10.1

 dns-server 192.168.10.1

!

interface GigabitEthernet1

 ip address 192.168.11.2 255.255.255.0

 negotiation auto

!

interface GigabitEthernet2

 ip address 192.168.10.1 255.255.255.0

 negotiation auto

CSR3

!

interface GigabitEthernet1

 ip address 192.168.12.2 255.255.255.0

 negotiation auto

!

ip http server

ip http authentication local

User will try to access cisco.com on http from machine having host entry of csr3 ip(192.168.12.2)