topic Re: Using time-based ACL + Regular Expression to block URLs in Network Security

Using time-based ACL + Regular Expression to block URLs

amanuelk — Sat, 08 Oct 2022 15:49:39 GMT

Hello Everyone

I am trying to block websites at a specific time, and for that, I thought of using time-based ACL with regular expression with MPF config.

Can someone please tell me if I can combine both and achieve my goal? Thanks.

Re: Using time-based ACL + Regular Expression to block URLs

MHM Cisco World — Sat, 08 Oct 2022 16:30:21 GMT

You have router or firewall?

Re: Using time-based ACL + Regular Expression to block URLs

amanuelk — Sat, 08 Oct 2022 16:39:01 GMT

Cisco Firewall ASA 5525

Re: Using time-based ACL + Regular Expression to block URLs

balaji.bandi — Sun, 09 Oct 2022 16:31:56 GMT

what ASA code running: check below the time-based ACL with some limitations:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/access-acls.html#ID-2069-000000e3

I am not sure you can combine both, but if the ACL accept regex then then the same ACL can be used for time based ( never tried but just get you an idea).

Re: Using time-based ACL + Regular Expression to block URLs

amanuelk — Tue, 11 Oct 2022 05:47:43 GMT

Hello @balaji.bandi

Thank you for your suggestion, but currently, I have ditched using the Cisco Firewall to monitor web filtering staff through ACL. Instead, I will use some other tools, but can I ask you something related to this or should I create a new topic?

I wanted to route traffic from a particular VLAN let's say on network 192.168.22.0 to the default gateway 192.168.18.2 (The tool am using to filter web), I have set 192.168.18.2 as the default-router option for dhcp-pool 22. How do I route those VLAN traffics to the default gateway from my core switch? Thanks

Re: Using time-based ACL + Regular Expression to block URLs

balaji.bandi — Tue, 11 Oct 2022 10:59:32 GMT

Most standard method people use WCCP redirection to redirect to Web traffic if the devices support.

if not you can PBR to redirect traffic to different next hop.

some example for your understanding :

https://www.cisco.com/c/en/us/support/docs/ip/ip-routed-protocols/47121-pbr-cmds-ce.html

Re: Using time-based ACL + Regular Expression to block URLs

MHM Cisco World — Tue, 11 Oct 2022 11:01:40 GMT

no need redirect if Host-CoreSW-GW share same broadcast domain then the Host can go to GW directly.

Re: Using time-based ACL + Regular Expression to block URLs

amanuelk — Thu, 13 Oct 2022 18:10:01 GMT

@balaji.bandi Thank you so much for your suggestions, PBR is what I was looking for and didn't know about it. I've tried that and somehow didn't work for me in my scenario, I will share my full net structure which I am trying right now.

Re: Using time-based ACL + Regular Expression to block URLs

amanuelk — Thu, 13 Oct 2022 18:12:49 GMT

@MHM Cisco WorldThank you so much for your suggestion, I am trying my best to access like that but I think I am missing something. Can you take look on my network structure that I have posted, Thank you.