topic Redirect any internet request to a certain url (i.e google.com) in Network Security

traffic redirects

Sirajhussain — Tue, 12 Mar 2019 00:34:43 GMT

Hi,

traffic redirects..

Re: Block internet and redirect them to custom url

Jouni Forss — Fri, 07 Dec 2012 18:47:45 GMT

Hi,

Well I'm not exactly sure if this is what you are looking for but you can define on the ASA that when certain users initiate for example a http/https connection that they will have to authenticate with the ASA first either using LOCAL or AAA-SERVER.

Initiating a HTTP/HTTPS connection should direct the users connection to ASA which asks for authentication before allowing the connection.

I for example tested on my home ASA just now with following configurations (This was just something i configured fast so it might be lacking)

Basic Configuration

username proxy password test privilege 0
access-list PROXY-TEST permit tcp host 10.0.0.5 any eq http
access-list PROXY-TEST permit tcp host 10.0.0.5 any eq https
aaa authentication match PROXY-TEST LAN LOCAL
aaa authentication listener http LAN port https redirect
aaa authentication listener https LAN port https redirect

Where

LAN = my LAN interface
LOCAL = Refers to the ASAs LOCAL AAA

Additional Commands

show uauth
- Show Authenticated users
clear uauth
- Clear authenticated user (or without username all)
timeout uauth xx:xx:xx absolute/inactivity
- Set the timeout value for authenticated user

If you want to know more about this you should Google for ASA Cut Through Proxy or check the same thing from the Configuration Guide.

- Jouni

Re: Block internet and redirect them to custom url

Jouni Forss — Fri, 07 Dec 2012 19:00:57 GMT

Also,

I think you can modify the Prompts the user gets when attempting the connection

There are commands:

auth-prompt prompt
auth-prompt accept
auth-prompt reject

- Jouni

Traffic Redirects

Sirajhussain — Fri, 07 Dec 2012 19:25:54 GMT

Yes, its the same

Block internet and redirect them to custom url

Jouni Forss — Fri, 07 Dec 2012 19:30:29 GMT

What I posted earlier will only make it so that certain users couldnt access the Internet unless they authenticate with the ASA first.

I dont think the ASA alone can do what you are asking with regards to redirecting users to a certain site. It would on the other hand block their connection attempts unless they had username/password needed to pass the authentication

- Jouni

Re: Block internet and redirect them to custom url

Sirajhussain — Fri, 07 Dec 2012 20:52:24 GMT

I understand that but thats not i want achieve

Redirect any internet request to a certain url (i.e google.com)

Sirajhussain — Sun, 09 Dec 2012 08:35:15 GMT

Hi,

Can anyone tell me what is needed to achieve above requirement? I mean if ASA alone cannot fulfill the requirement.

Regards,

Re: Redirect any internet request to a certain url (i.e google.c

Jernej Vodopivec — Sun, 09 Dec 2012 09:04:21 GMT

You can redirect http traffic to certain IP address but not url if that solves your problem also?

1. create network object for those IPs that don't have access to internet:
object network banned-ips
subnet 1.2.3.0 255.255.255.0

2. create network object for all ip addresses:
object network internet
subnet 0.0.0.0 0.0.0.0

3. create network object for web server
object network web-server
host 11.22.33.44

4. create service object for http traffic
object service http-traffic
service tcp destination eq http

4. create nat rule to translate http traffic to web server
nat(inside,outside) 10 source static banned-ips interface destination static internet web-server service http-traffic http-traffic

Hope that solves your problem.

Traffic Redirects

Sirajhussain — Sun, 09 Dec 2012 12:53:45 GMT

Well that command will not accept in current version

Redirect any internet request to a certain url (i.e google.com)

Jernej Vodopivec — Sun, 09 Dec 2012 15:54:36 GMT

Hi Sirajhusen,

sorry, I overlooked you're still running pre 8.3 version you mentioned in your first post.

I would recommend you upgrade to post 8.2 version which offers you much more flexibility when configuring nat rules. And you could also benefit from new features like AD integration, scansafe connector...

Is this possible in your case?

Redirect any internet request to a certain url (i.e google.com)

Sirajhussain — Sun, 09 Dec 2012 16:14:36 GMT

Thanks Jernej,

You mean the pre 8.3 version will not solve the problem, right? This an urgent requirement pls suggest if any other way.

I already gone through the below link of pre 8.3 to 8.3 NAT config examples

https://supportforums.cisco.com/docs/DOC-9129

Regards,