How to Block Teamviewer application on ASA5510

[tabish bhat]

Hi

Guys, i need your help i want to block teamviewer for certain ip adds 

Any idea...

Regards

Tabish Bhat.

[Anu M Chacko]

Hi Tabish,

Could you please try the following and let me know?

regex teamviewer “\.teamviewer\.com”

class-map type regex match-any block

match regex teamviewer

class-map allow_teamviewer

match access-group allow_teamviewer

access-list allow_teamview permit ip

policy-map type inspect http http-pol

parameters

match request header host regex class block

drop log

policy-map global_policy

  class allow_teamviewer

  inspect http http-pol

You can specify the IP addresses in the class-map allow_teamviewer. Hope this helps!

Regards,

Anu

P.S. Please mark this question as answered if it has been resolved. Do rate helpful posts. Thanks!

[tabish bhat]

Hi Anu,

Thanks for your prompt reply !!

I tried MPF given by you, but it did not work !

Regards

Tash

[Anu M Chacko]

Hi Tash,

Could you try it without the access-list and see if it gets blocked?

regex teamviewer “\.teamviewer\.com”

class-map type regex match-any block

match regex teamviewer

policy-map type inspect http http-pol

parameters

match request header host regex class block

drop log

policy-map global_policy

  class inspection_default

  inspect http http-pol

Let me know.

Regards,

Anu

[tabish bhat]

Hi Anu,

I tried without access-list still it is not working

Regards

Tash Bhat

[Anu M Chacko]

Hi Tash,

You are trying to access "teamviewer.com" right? Let's try blocking DNS requests to this site. Try this:

regex teamviewer “\.teamviewer\.com”                     //This is "slash","dot","teamviewer","slash","dot","com"

class-map type regex match-any block

match regex teamviewer

policy-map type inspect dns dns-pol

parameters

message-length maximum 512

match domain-name regex class block

drop log

policy-map global_policy

  class inspection_default

  inspect dns dns-pol

Let me know.

Regards,

Anu

[tabish bhat]

Hi Anu,

For your information i am trying to block teamviewer application not website,The problem is even if i am trying to block url also, it is not blocking it

i am confused why MPF is not working ,i also tried to block "teamviewer.com" but it is not happening......May be the "regex" is not matching

what to do now ?

Regards

Tash Bhat