how to allow few url and block other in cisco asa 5510

[Hardik Vaidh]

how to allow few url and block other in cisco asa 5510

[Eugene Korneychuk]

Hello Hardik,

In this example we will allow only cisco.com, and block everything else:

regex allowex2 "cisco\.com"

class-map type inspect http match-all allow-url-class
 match not request header host regex allowex2

policy-map type inspect http allow-url-policy
 parameters
 class allow-url-class
  drop-connection log
policy-map global_policy
 class inspection_default
  inspect http allow-url-policy

service-policy global_policy global

Hope it helps

[Hardik Vaidh]

thnx

http and https both are block ??

[Eugene Korneychuk · Accepted solution]

Hello Hardick,

Only http.

HTTPS filtering is not supported on ASA. ASA cannot do deep packet   inspection or inspection based on regular expression for HTTPS traffic,  because  in HTTPS, content of packet is encrypted (SSL).

You  can also use URL filtering to direct specific traffic to an external   filtering server, such an Secure Computing SmartFilter (formerly N2H2)  or  Websense filtering server. Long URL, HTTPS, and FTP filtering can  now be enabled  using both Websense and Secure Computing SmartFilter for  URL filtering.  Filtering servers can block traffic to specific sites  or types of sites, as  specified by the security policy.

For more information on URL filters, refer the following URLs:

http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/filter.html#wp1042606

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008088517b.shtml

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml

Please, rate helpful posts

[Hardik Vaidh]

thnx a lot dear...

I have more then two remote site.. and i want to block and allow url each center but every center have different requirement ... so it is possible in one cisco 5510 ASA for multiple location.. ?

[Eugene Korneychuk]

You can configure different regex, for different requirement.

[Hardik Vaidh]

ok thnx will check.. thnx a lot