Facebook block on ASA

[samith_me]

Can you help me to block facebook on office time ( 9.00 am - 5.00 PM) on asa. I tried with time based ACL. But dificulty is facebook has lot of public IPs. from ACL can block one IP or range only. can you help me, please ?

[Flavio Miranda]

Take a look on this post:

https://supportforums.cisco.com/t5/firewalling/how-to-block-facebook-using-asa/td-p/1726664

[Philip D'Ath]

This is a nice simple method that blocks http and https - because it blocks the DNS queries.

regex domain_facebook.com "facebook\.com"

class-map type regex match-any DomainBlockList
  description Blocked Domains
  match regex domain_facebook.com

policy-map type inspect dns PM-DNS-inspect
 parameters
  message-length maximum 512

 match domain-name regex class DomainBlockList
  drop-connection log

policy-map global_policy
 class inspection_default
  inspect dns PM-DNS-inspect

[jumora1]

What model of ASA do you have?