Well I'm not exactly sure if this is what you are looking for but you can define on the ASA that when certain users initiate for example a http/https connection that they will have to authenticate with the ASA first either using LOCAL or AAA-SERVER.
Initiating a HTTP/HTTPS connection should direct the users connection to ASA which asks for authentication before allowing the connection.
I for example tested on my home ASA just now with following configurations (This was just something i configured fast so it might be lacking)
If you want to know more about this you should Google for ASA Cut Through Proxy or check the same thing from the Configuration Guide.
What I posted earlier will only make it so that certain users couldnt access the Internet unless they authenticate with the ASA first.
I dont think the ASA alone can do what you are asking with regards to redirecting users to a certain site. It would on the other hand block their connection attempts unless they had username/password needed to pass the authentication
You can redirect http traffic to certain IP address but not url if that solves your problem also?
1. create network object for those IPs that don't have access to internet:
object network banned-ips
subnet 220.127.116.11 255.255.255.0
2. create network object for all ip addresses:
object network internet
subnet 0.0.0.0 0.0.0.0
3. create network object for web server
object network web-server
4. create service object for http traffic
object service http-traffic
service tcp destination eq http
4. create nat rule to translate http traffic to web server
nat(inside,outside) 10 source static banned-ips interface destination static internet web-server service http-traffic http-traffic
Hope that solves your problem.
sorry, I overlooked you're still running pre 8.3 version you mentioned in your first post.
I would recommend you upgrade to post 8.2 version which offers you much more flexibility when configuring nat rules. And you could also benefit from new features like AD integration, scansafe connector...
Is this possible in your case?