topic Re: blocking URLS with MPF in Network Security

blocking URLS with MPF

networker99 — Mon, 11 Mar 2019 18:08:49 GMT

I would like to write a policy on the ASA to block any URL with the word "facebook" in it, except for www.facebook.com so www.wwfacebook.com and www.wwwfacebook.com would be blocked but www.facebook.com would not.

I believe the blocking policy should look like below, but I am unsure how I should create an exception to allow www.facebook.com

regex blockex1 "/facebook/"

class-map type inspect http match-any block-url-class
match request uri regex blockex1

policy-map type inspect http block-url-policy
parameters
class block-url-class
drop-connection log
policy-map global_policy
class inspection_default
inspect http block-url-policy

service-policy global_policy global

Re: blocking URLS with MPF

Kevin Redmon — Thu, 08 Jul 2010 15:54:03 GMT

You can create a more specific regex that will match www.facebook.com and put that policy first in the MPF policy-map. When this traffic is matched (ie when someone goes to www.facebook.com), this class of traffic will be matched first and will allow that connection. When the user attempts to go to any other website with 'facebook' in the URL, it will NOT match the first policy (for www.facebook.com) but will match the second policy (matching 'facebook' anywhere else in the URL) and will be dropped.

Best Regards,

Kevin

Re: blocking URLS with MPF

networker99 — Thu, 08 Jul 2010 16:32:41 GMT

Great, but what action do I apply to the permit traffic? as their is no forward or permit

Re: blocking URLS with MPF

Kevin Redmon — Thu, 08 Jul 2010 18:40:37 GMT

No need to put an action for the 'www.facebook.com' instance - leaving the
policy blank should do the trick.

Hope this helps!

Best Regards,

Kevin

Re: blocking URLS with MPF

Nagaraja Thanthry — Thu, 08 Jul 2010 18:45:33 GMT

Hello,

Please check out the example configurations in the link below:

https://supportforums.cisco.com/docs/DOC-1268;jsessionid=04C0678692F3EDA69D5921326AEC1195.node0

Hope this helps you in configuring the allow part.

Regards,