topic Re: Block Web Sites in Network Security

Block Web Sites

ray_stone — Mon, 11 Mar 2019 13:13:05 GMT

hi, Is there anything through which it could be possible to block the webpage instead of making access list into FW as other FW has same feature. Thanks

Re: Block Web Sites

Marwan ALshawi — Sun, 13 Jul 2008 00:26:49 GMT

sure u can

this is example to u to block yahoo.com

regex web1 "\.yahoo\.com"

make acl to match the direction from where to where the traffic for this url to be block

lets say from inside to outside toward the internet

access-list url-acl extended permit tcp (ur inside network with mask) any eq www

class-map type regex match-any url-lists

match regex web1

(and u can add more regex matching here)

then

class-map type inspect http match-all url-block

match request header host regex class url-lists

class-map httptraffic

match access-list url-acl

policy-map type inspect http http-policy

class url-block

reset log

policy-map url-block-policy

class httptraffic

inspect http http-policy

then apply it to the source of your trafffic as we assumed the inside interface

sevice-policy url-block-policy interface inside

becarefull with matching statements any mistake may lead to not blocking

and becarefull also with the REGEX

good luck

Please Rate if helpful

Re: Block Web Sites

ray_stone — Sun, 13 Jul 2008 10:16:11 GMT

Thanks for this valuable information. I appreciate. Now I want to fix downloding bandthwidth on the users. We have a 1MB link 1:1 ratio and I want that a particular user could able only to use upto 20 kb but not higher. Is there any solution??? Thnks.

Re: Block Web Sites

Marwan ALshawi — Sun, 13 Jul 2008 12:14:10 GMT

first of all here in neyPro we use rating for helpful post

so please, rate for each help helpful post !

and about limiting u can use policing with policy maps

as fowllow

make and acl matching the particular user ip traffic or any spisific type of traffic

access-list 100 permit ip host (user ip) any

then

class-map limit-class

match access-list 100

policy-map limit-policy

class limit-class

police input 20000 confirm-action transmit exceed-action drop

then apply it to ur inside einterface to limit the outbound traffic for that user

service-policy limit-policy interface inside

remember u can have one policy on each interface per direction

so if u have configured the prevous one for web url filtering u have to add the class-map and this policy config to the same prevous policy

good luck and rate if helpful

let me know if its worked

Re: Block Web Sites

ray_stone — Sun, 13 Jul 2008 13:24:16 GMT

Can u send me a any link of example, if possible. Thanks

Re: Block Web Sites

Marwan ALshawi — Sun, 13 Jul 2008 13:31:06 GMT

use this link

i think good usefull

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008084de0c.shtml

good luck

Re: Block Web Sites

ray_stone — Sun, 13 Jul 2008 13:39:41 GMT

Thanks, I appreciate... Are you from India?

Re: Block Web Sites

Marwan ALshawi — Sun, 13 Jul 2008 13:40:51 GMT

no, and good luck