topic Url filtering issue with CBAC in Network Security

Url filtering issue with CBAC

mahesh18 — Tue, 12 Mar 2019 01:32:31 GMT

Hi Everyone,

I was trying Basic url filtering BY CBAC on router

using CBAC (Context-Based Access Control) :

!
ip inspect name WEBFILTER http urlfilter
ip urlfilter allow-mode on
ip urlfilter exclusive-domain deny .yahoo.com
!
!
interface FastEthernet 0
   desc Internal
   ip inspect WEBFILTER out

where fa0 is interface of 1811w that connects to 3550.

My home setup is like this 1811w is wi fi router which has ospf to 3550 and 3550 has connection to edge router.

Edge router connects to ISP.

On edge router i used outgoing interface that connects to ISP modem.

I have config the above command on edge router but i am still able to access the yahoo.com.

i tried on 1811W router still able to access the yahoo.com

When i try on interface with out direction then i do not see any sis connections.

Need to know which device i should config url filtering and which interface and direction?

Thanks

Mahesh

Url filtering issue with CBAC

Maykol Rojas — Mon, 22 Apr 2013 03:14:07 GMT

Mahesh,

If the Fa0 Is the one that connects to the internal network, then the direction needs to be in, which means that the GET packet from the client is getting inbound on that interface.

Change that and it should work.

https://supportforums.cisco.com/docs/DOC-20563

Mike Rojas.

Url filtering issue with CBAC

mahesh18 — Mon, 22 Apr 2013 03:29:46 GMT

Hi Rojas,

I followed that link earlier and did my config from there.

Now changed interface direction to inside same thing.

Still able to access the yahoo.com.

Thanks

Mahesh

Url filtering issue with CBAC

Maykol Rojas — Mon, 22 Apr 2013 03:38:16 GMT

Hi Mahesh,

So the clients are comming from the Fa0? Would you be able to post the following?

Show run | inc ip inspect

Show run inteface fa0

Mike Rojas.

Url filtering issue with CBAC

mahesh18 — Mon, 22 Apr 2013 03:40:53 GMT

Hi,

Here is info

interface FastEthernet0

description IPSEC OSPF TO 3550A Interface Fas 0/8

ip address 192.168.99.1 255.255.255.0

ip inspect WEBFILTER in

ip virtual-reassembly

duplex auto

speed auto

crypto map VPN_MAP

1811w# Show run | inc ip inspect

ip inspect name WEBFILTER http urlfilter

ip inspect WEBFILTER in

1811w#

Thanks

Mahesh

Url filtering issue with CBAC

Maykol Rojas — Mon, 22 Apr 2013 03:51:39 GMT

Mahesh,

Can you try your website without the first dot? IE

ip urlfilter exclusive-domain deny yahoo.com

Let me know.

Url filtering issue with CBAC

mahesh18 — Mon, 22 Apr 2013 03:57:25 GMT

Hi,

tried without same thing .

thanks

mahesh

Url filtering issue with CBAC

Maykol Rojas — Mon, 22 Apr 2013 04:03:03 GMT

Mahesh,

Let me try it out with your config....ill update in 20 minutes.

Mike Rojas.

Url filtering issue with CBAC

mahesh18 — Mon, 22 Apr 2013 04:07:17 GMT

Hi Maykol,

Will wait for your reply

thanks

Mahesh

Url filtering issue with CBAC

Maykol Rojas — Mon, 22 Apr 2013 05:01:38 GMT

Hello Mahesh,

It does work for me.. Here is my config:

interface FastEthernet0/1

ip address 10.1.1.1 255.255.255.0

ip inspect WEB in

duplex auto

speed auto

ip urlfilter allow-mode on

ip urlfilter exclusive-domain deny yahoo.com

ip inspect name WEB http urlfilter

With this config, if you go to yahoo.com it would be blocked. Now, if you try, www.yahoo.com it goes through, if you try again, yahoo.com, it would go through based on how the browser behaves.

Have this same config, erase the cache on the web browser and try again.

Mike Rojas.

Url filtering issue with CBAC

mahesh18 — Mon, 22 Apr 2013 05:19:54 GMT

Hi Mike,

I tried this few times no luck.

also when i do sh ip inspect sis output is blank.

thanks for all the help and trying this in your lab.

mahesh