topic Re: URL filtering on 5505? in Network Security

URL filtering on 5505?

slug420 — Mon, 11 Mar 2019 19:46:04 GMT

Can someone help me with a basic config to filter like cisco.com (or any of its pages) using a 5505? I am trying to *block* this site. Here is what I had from the URL filtering howto:

!
class-map inspection_default
match default-inspection-traffic
class-map type inspect http match-any block-url-class
match request header host regex block1
!
!
policy-map type inspect http block-url-policy
parameters
class block-url-class
drop-connection log
policy-map global_policy
class inspection_default
inspect http block-url-policy
!
service-policy global_policy global

I got an error initially about there being no inspection_default class so im not sure if I recreated it correctly/completely...

thanks!

Re: URL filtering on 5505?

PAUL GILBERT ARIAS — Mon, 07 Feb 2011 19:07:34 GMT

can you paste the show run regex, show run class-map and show run policy-map?

Re: URL filtering on 5505?

PAUL GILBERT ARIAS — Mon, 07 Feb 2011 19:08:36 GMT

this link provides a good explanation:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml

Re: URL filtering on 5505?

PAUL GILBERT ARIAS — Mon, 07 Feb 2011 19:29:10 GMT

this is a configuration I have tested:

regex block-url ".\myspace.\com"

class-map type regex match-any cm-block-url

match regex block-url

policy-map type inspect http pm-block-url

parameters

match request header host regex class cm-block-url

drop-connection log

policy-map global_policy

class inspection_default

inspect http pm-block-url

service-policy global_policy global

Re: URL filtering on 5505?

slug420 — Wed, 09 Feb 2011 16:45:10 GMT

Thanks Paul, I am trying your config but where you have:

class inspection_default

inspect http pm-block-url

I do not see an "inspect" command to issue "inspect http"?

Re: URL filtering on 5505?

PAUL GILBERT ARIAS — Wed, 09 Feb 2011 16:51:46 GMT

clas inspectio_default comes by default on the ASA. In case you don't have it then you could add it manually. Here are the missing lines:

class-map inspection_default

match default-inspection-traffic

then make sure you add the rest of the commands I suggested.

Re: URL filtering on 5505?

slug420 — Wed, 09 Feb 2011 20:58:29 GMT

you:

regex block-url ".\myspace.\com"

class-map type regex match-any cm-block-url

match regex block-url

policy-map type inspect http pm-block-url

parameters

match request header host regex class cm-block-url

drop-connection log

policy-map global_policy

class inspection_default

inspect http pm-block-url

service-policy global_policy global

me (testing with pandora):

regex block1 ".\pandora.\com"

class-map inspection_default
match default-inspection-traffic

class-map type regex match-any block-url-class
match regex block1
!
!
policy-map type inspect http block-url-policy
parameters
match request header host regex class block-url-class
drop-connection log
policy-map global_policy
class inspection_default
inspect http block-url-policy
!
service-policy global_policy global

don't the !s indicate incomplete configurations? Do you have those in your config? If this looks good to you (looks good to me) I guess I am going to have to verify the user is testing from the right location..

Re: URL filtering on 5505?

PAUL GILBERT ARIAS — Wed, 09 Feb 2011 21:05:01 GMT

it doesn't mean incomplete.

Go ahead and test. It looks good your config.

Re: URL filtering on 5505?

slug420 — Thu, 10 Feb 2011 20:42:02 GMT

tried it on an ASA here and it worked like a charm, client finally got back to me and said he was testing from another site Thanks for your help! On a side note...if they ping the URL (and resolve the IP) and use the IP in their web browser they get around this...is there a way to do DNS filtering so that requests or responses for a given string are blocked?

Re: URL filtering on 5505?

PAUL GILBERT ARIAS — Thu, 10 Feb 2011 21:09:49 GMT

I am glad to hear that it worked. You can always block the IP for the unwanted websites but IPs usually change. If you want a better URL filtering mechanism you should consider the CSC-SSM for the ASA but in this case it will not work on you ASA 5505.