topic Re: How to block website Cisco ASA using MPF? in Network Security

How to block website Cisco ASA using MPF?

Jameel Ahmed — Fri, 21 Feb 2020 16:18:11 GMT

Hi everyone,

our firewall is currently on code 8.2. i want to know how to block a specific website using MPF and dropping dns query.

i am able to block it for whole inside network but not for a specific ip address or group of ips.

here is the code i am using.

name 192.168.66.25 dummy-user
access-list dummy-user-rl extended permit ip any host dummy-user
access-list dummy-user-rl extended permit ip host dummy-user any
global (outisde) 17 201.xxx.yyy.zzz
nat (inside) 17 dummy-user 255.255.255.255
!
regex domain_netflix.com "\.netflix\.com"
!
class-map dummy-user-rl
match access-list dummy-user-rl
!
class-map type inspect dns match-all cm-dbl
description Blocked Domains
match domain-name regex domain_netflix.com
!
policy-map type inspect dns dns-inspect-pm
parameters
message-length maximum 512
match domain-name regex domain_netflix.com
class cm-dbl
drop log
!
policy-map global_policy
class dummy-user-rl
police input 4000000 12375
police output 4000000 12375
inspect dns dns-inspect-pm
!
service-policy global_policy global

Re: How to block website Cisco ASA using MPF?

balaji.bandi — Mon, 01 Oct 2018 13:49:29 GMT

So you looking only specific IP to block this URL is this correct,

If so please refer below document, should be help for you to resolve.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100513-ASARegexp.html#req

Re: How to block website Cisco ASA using MPF?

Jameel Ahmed — Tue, 02 Oct 2018 12:24:47 GMT

The link you shared is about OS version >=8.3. i am using version 8.2.

Re: How to block website Cisco ASA using MPF?

Marius Gunnerud — Tue, 02 Oct 2018 15:14:01 GMT

Try the following:

regex block-netflix.com "netflix\.com"

class-map type regex match-any DOMAIN-BLOCK

match regex block-netflix.com

policy-map type inspect dns dns-inspect-pm

match domain-name regex class DOMAIN-BLOCK

drop-connection log

policy-map global_policy
class dummy-user-rl
police input 4000000 12375
police output 4000000 12375
inspect dns dns-inspect-pm

service-policy global_policy global