topic ASA Urlfiltering Multiple Classes in Network Security

ASA Urlfiltering Multiple Classes

Steven Mills — Mon, 11 Mar 2019 20:48:48 GMT

Hello,

I am trying to configure an ASA 5510 so that it performs URL filtering for two different subnets, the Head Office subnet should just block facebook and myspace and the stores group should only be allowed access to the cisco website and wikipedia. I have the following configuration:

regex STORE-URL-REGEX1 "\.cisco\.com"

regex STORE-URL-REGEX2 "\.wikipedia\.com"

regex HO-URL-REGEX0 "\.facebook\.com"

regex HO-URL-REGEX1 "\.myspace\.com"

access-list HO-URLFILTER-ACL extended permit tcp 10.0.0.0 255.255.255.0 any eq www

access-list STORE-URLFILTER-ACL extended permit tcp 192.168.254.0 255.255.255.0 any eq www

class-map HO-URLFILTER-CLASS

match access-list HO-URLFILTER-ACL

class-map STORE-URLFILTER-CLASS

match access-list STORE-URLFILTER-ACL

class-map type inspect http match-any HO-URLFILTER-REGEX-CLASS

match request header host regex HO-URL-REGEX0

match request header host regex HO-URL-REGEX1

class-map type regex match-any SITE-BLOCKED-REGEX-URLS

match regex STORE-URL-REGEX0

match regex STORE-URL-REGEX1

class-map type inspect http match-any STORE-URLFILTER-REGEX-CLASS

match not request header host regex class SITE-BLOCKED-REGEX-URLS

policy-map type inspect http HO-HTTP-URLFILTER-POLICY

parameters

class HO-URLFILTER-REGEX-CLASS

drop-connection log

policy-map type inspect http STORE-HTTP-URLFILTER-POLICY

parameters

class STORE-URLFILTER-REGEX-CLASS

drop-connection log

policy-map global_policy

class HO-URLFILTER-CLASS

inspect http HO-HTTP-URLFILTER-POLICY

class STORE-URLFILTER-CLASS

inspect http STORE-HTTP-URLFILTER-POLICY

The config works perfectly individually, my issue is that only the first class (either HO-URLFILTER-CLASS or STORE-URLFILTER-CLASS) in the global_policy policy-map matches and is inspected. The class below it doesn't work unless I change the order in the policy map.

Is there anything I can do to make this work as I described?

Thanks for any help.

ASA Urlfiltering Multiple Classes

Kureli Sankar — Wed, 22 Jun 2011 13:40:36 GMT

Steve,

How about you configure a new policy-map and apply it on the inside interface for one class-map and leave the other in the global policy?

-KS

ASA Urlfiltering Multiple Classes

Steven Mills — Wed, 22 Jun 2011 20:31:28 GMT

I have currently kludged it by applying the Head Office blocking on a 2821 router that is also in the path but is the method I have used with multiple class maps meant to work or can you apply multiple policy-maps to an interface, for instance if I wanted to filter three groups? It is running an older software revision, could it be a bug or is this excpected behaviour?

Thanks.

ASA Urlfiltering Multiple Classes

praprama — Wed, 29 Jun 2011 21:02:36 GMT

Hi Steve,

The configuration looks good and ideally should work. Based on your description, the behavior does look out of the normal. One thing i would like you to try is instead of applying the 2 class-maps to the global_policy, try appling them to the interface on which the packets come in to the ASA. If you do this, do you still see the same behavior?

It may be worth running a few debugs and getting a few captures as well as debugs to see what exactly is going on. Before we go to that, let me know what happens with the interface specific plicy.

Regards,

Prapanch