Blocking https sites such as youtube with policy map

[chandogetrude]

Hi everybody,

Please can someone help me with this?

I wanted to block users in my company network from visiting social networking sites like  youtube etc, I used the configuration below but it not working.

class-map match-any YOUTUBE-URL-FILTER
match protocol http host "*.youtube.com*"

Policy Map youtube
Class YOUTUBE-URL-FILTER
drop

int xxxx
ip nbar protocol-discovery
service-policy output youtube

[Joseph W. Doherty]

You're sure egress on that interface would have the URL?

I don't recall if NBAR HTTP also matches HTTPS, but as youtube now seems to use the latter, if NBAR doesn't, that could explain your protocol match failure.

BTW, don't believe you need to enable NBAR protocol discovery to use NBAR as you're doing.