topic Re: Block Certain Websites (URLs) Using Regular Expressions in Network Security

Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Mon, 11 Mar 2019 19:43:06 GMT

hello everyone i am kinda new to cisco product, i have cisco asa 5510 as firewall, i was trying to block some site using the link provided below

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml#tshoot

and its working fine, but the problem i am having, when i go to download attachment from hotmail its not downloading, from gmail and other mails its

working any one could help me on this

Re: Block Certain Websites (URLs) Using Regular Expressions

Nagaraja Thanthry — Tue, 01 Feb 2011 23:32:43 GMT

Hello,

Can you please post your configuration here (both regular expression statements and class-map/policy-map statements)?

Regards,

Re: Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Mon, 07 Feb 2011 18:16:58 GMT

thanks for reply, and sorry for the late reply from i was away for some time from the work iam attaching the screen shots of regular expression, classmap and inspect map also policy which i created

Re: Block Certain Websites (URLs) Using Regular Expressions

PAUL GILBERT ARIAS — Mon, 07 Feb 2011 19:11:21 GMT

from CLI can you paste the show run regex, show run class-map and show run policy-map?

Re: Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Tue, 08 Feb 2011 15:05:13 GMT

yes these are the results, and thanks for the reply

show run regex

regex urllist1 ".*\.([Ff][Ll][Vv])HTTP/1.[01]"
regex domainlist1 "\.youtube\.com"
regex ares "[ares]"
regex contenttype "Content-Type"
regex applicationheader "application/.*"

show run class-map

!
class-map inside-unres-band-in
description Assign 16MB unrestricted IPs outgoing request
match access-list inside_mpc
class-map inside-class-unrestricted-in
description Prioritize unrestricted IPs outgoing request
match access-list inside_mpc_2
class-map type regex match-any DomainBlocklist
match regex domainlist1
class-map type inspect http match-all BlockDomainClass
match request header host regex class DomainBlocklist
class-map type regex match-any block
match regex _default_x-kazaa-network
match regex _default_aim-messenger
match regex _default_gator
class-map inside-unres-band-out
description Assign 16MB unrestricted IPs return traffic
match access-list inside_mpc_1
class-map inspection_default
match default-inspection-traffic
class-map inside-class-unrestricted-out
description Prioritize unrestricted IPs return traffic
match access-list inside_mpc_3
!

show run policy-map

in the policy-map i have some rules for badwidth restrictions. and i have the httpaccess rule (site blocking). on top of the default class map rule

!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect esmtp
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect sip
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
inspect rtsp
policy-map type inspect http http_inspec_allow
parameters
protocol-violation action drop-connection
match request method connect
log
class BlockDomainClass
log
policy-map type inspect http Ares
parameters
protocol-violation action drop-connection
match request uri regex ares
drop-connection log
policy-map type inspect http block
parameters
protocol-violation action drop-connection
match request uri regex class block
drop-connection log
policy-map type inspect http http_inspec_pol
parameters
protocol-violation action drop-connection
match request method connect
drop-connection log
class BlockDomainClass
reset
policy-map type inspect im IM-Inspect-map
parameters
match protocol msn-im yahoo-im
drop-connection
policy-map inside-policy-res-bandwidth
class inside-unres-band-in
police input 16000000 8000
police output 16000000 8000
class inside-class-unrestricted-in
police input 16000000 8000
police output 16000000 8000
class inside-unres-band-out
police output 16000000 8000
police input 16000000 8000
class inside-class-unrestricted-out
police input 16000000 8000
police output 16000000 8000
class httpaccess
inspect http http_inspec_pol
class class-default
police input 4500000 2700
police output 4500000 2700
policy-map type inspect im imallow
parameters
match protocol msn-im yahoo-im
log
!

Re: Block Certain Websites (URLs) Using Regular Expressions

mirober2 — Tue, 08 Feb 2011 20:30:43 GMT

Hi Jibin,

Does the ASA log any syslogs when the connection is blocked?

Also, could you get a packet capture on the client for a connection that is blocked? I don't have a Hotmail account to test with, but I'm wondering if this regex might be matching something in the request:

regex ares "[ares]"

-Mike

Re: Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Wed, 09 Feb 2011 20:26:36 GMT

hello

yes syslog is ther, and also i have another problem one i put this rule in policy after sometime syslog will loose connection

i dont know i have can i capture packet from asa can you help me on this.

i have the syslog reports if you want below

attaching as txt file

Re: Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Wed, 09 Feb 2011 20:31:27 GMT

and the regex ares wasnt really using i was using that for testing i removed all that and tried its same problem

Re: Block Certain Websites (URLs) Using Regular Expressions

PAUL GILBERT ARIAS — Wed, 09 Feb 2011 21:30:10 GMT

can you include the show run service-policy?

Re: Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Thu, 10 Feb 2011 12:55:04 GMT

yes this is the result

Result of the command: "show run service-policy"

service-policy global_policy global
service-policy inside-policy-res-bandwidth interface inside

Re: Block Certain Websites (URLs) Using Regular Expressions

PAUL GILBERT ARIAS — Thu, 10 Feb 2011 14:13:19 GMT

have you tried applying the inspect http inside the global policy?

Like this:

policy-map global_policy

class httpaccess

inspect http http_inspec_pol

Re: Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Thu, 10 Feb 2011 16:13:14 GMT

i havent tried in global policy i will try that i let you know

thanks

Re: Block Certain Websites (URLs) Using Regular Expressions

jibinkg — Thu, 10 Feb 2011 20:11:45 GMT

yes i tried in the global policy still same problem

Block Certain Websites (URLs) Using Regular Expressions

vinlata2007 — Thu, 03 May 2012 16:05:54 GMT

Hi Jibbin,

I know it's been awhile, but wonder if you got solutions to your issues? I tried to do the same, want to block some cloud video service and internet radio like netflix, hulu, pandora...it seemed working great as for blocking those sites but at the same time it block certain web forms and active-X apps from other business sites (not on the url block lists) as well. I can log on to hotmail, gmail and check

email no problem.

Thanks

Hey folks,i have also used

usman ali dar — Wed, 08 Apr 2015 15:45:22 GMT

Hey folks,

i have also used the same method and it just work fine additionally i have placed a small policy map on internet edge router which deprecate the required traffic which is identified by NBAR to dscp 1 and a url list which says nothing comins in with .torrent.

after this i have seen a huge difference in my network traffic which is aprox 289 Gigs IN and 345 Out the difference is from last 15 days.