Restriction of Web Sites
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-15-2009 06:29 AM - edited 03-11-2019 08:32 AM
Greetings, All.
Due to a *very* stringent security policy, the users behind a specific ASA 5505 (v 8.04) will only be allowed to access a limited number of web sites. For simplicities sake, let's just say they can only access www.espn.com and www.yahoo.com, and nothing else.
I've monkeyed with the configs a bit and haven't had any luck. I've attached the config with which I've tried to make this happen. Perhaps I'm close? Is my access list jacked? With this config, everything is blocked...including espn and yahoo. Not exactly what I want.
URL filtering is not an option as WebSense will be too costly.
I do know that you can keep users from visiting specific sites (gambling, porn, etc;), but what if you want to keep the users from visiting any site except maybe 1 or 2?
Thanks in advance.
- Labels:
-
NGFW Firewalls

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-15-2009 06:44 AM
I believe you can only block certain websites, rather than allow certain websites, therefore regexp is no use to you really.
REGEXP config example here:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940c5a.shtml
Only other option (and it costs) is to purchase a CSC-SSM module. More info here:
Good luck :-)

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-15-2009 07:46 AM
You can limit where people go with regex and class maps. I have a handful of users that are only allowed to go to certain sites, and here's what I did:
Create your acl:
access-list RESTRICTED permit ip host 192.168.1.5 any
Match that ACL:
class-map RESTRICTED
match access-list RESTRICTED
Create your regex:
regex espn "\.espn\.com"
Create your regex class-map:
class-map type regex match-any Internet_Allowed
match regex espn
Inspect the regex class map, but only allow what DOESN'T match:
class-map type inspect http match-all INTERNET_RESTRICTED
match not request header host regex class Internet_Allowed
Create a policy map to perform actions on above:
policy-map type inspect http RESTRICTED_INTERNET
class INTERNET_RESTRICTED
reset log
(The reset above will reset any connection that DOESN'T match your regex. It allows only espn.com.)
Then create a policy to apply to the inside interface:
policy-map INSIDE
class RESTRICTED
inspect http RESTRICTED_INTERNET
(The class above matches the acl for your hosts, and the it applies the other policy map RESTRICTED_INTERNET to scan against your acl.)
HTH,
John
