Restriction of Web Sites

[cavemanbobby]

Greetings, All.

Due to a *very* stringent security policy, the users behind a specific ASA 5505 (v 8.04) will only be allowed to access a limited number of web sites. For simplicities sake, let's just say they can only access www.espn.com and www.yahoo.com, and nothing else.

I've monkeyed with the configs a bit and haven't had any luck. I've attached the config with which I've tried to make this happen. Perhaps I'm close? Is my access list jacked? With this config, everything is blocked...including espn and yahoo. Not exactly what I want.

URL filtering is not an option as WebSense will be too costly.

I do know that you can keep users from visiting specific sites (gambling, porn, etc;), but what if you want to keep the users from visiting any site except maybe 1 or 2?

Thanks in advance.

[handsy]

I believe you can only block certain websites, rather than allow certain websites, therefore regexp is no use to you really.

REGEXP config example here:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940c5a.shtml

Only other option (and it costs) is to purchase a CSC-SSM module. More info here:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6823/product_data_sheet0900aecd80402e4f_ps6120_Products_Data_Sheet.html

Good luck :-)

[John Blakley]

You can limit where people go with regex and class maps. I have a handful of users that are only allowed to go to certain sites, and here's what I did:

Create your acl:

access-list RESTRICTED permit ip host 192.168.1.5 any

Match that ACL:

class-map RESTRICTED

match access-list RESTRICTED

Create your regex:

regex espn "\.espn\.com"

Create your regex class-map:

class-map type regex match-any Internet_Allowed

match regex espn

Inspect the regex class map, but only allow what DOESN'T match:

class-map type inspect http match-all INTERNET_RESTRICTED

match not request header host regex class Internet_Allowed

Create a policy map to perform actions on above:

policy-map type inspect http RESTRICTED_INTERNET

class INTERNET_RESTRICTED

reset log

(The reset above will reset any connection that DOESN'T match your regex. It allows only espn.com.)

Then create a policy to apply to the inside interface:

policy-map INSIDE

class RESTRICTED

inspect http RESTRICTED_INTERNET

(The class above matches the acl for your hosts, and the it applies the other policy map RESTRICTED_INTERNET to scan against your acl.)

HTH,

John