site block

[rk6171485]

how can i block youtube from cisco L3 switch completely for all system.

[MHM Cisco World]

I will check if L3SW accept ACL with hostname not IP

[rk6171485]

please check and provide the completed best solutions.

[M02@rt37]

Hello @rk6171485,

best way with hostname on ACL instead of IP ... @MHM Cisco World is checking I think.

If not, you can retrieve youtube IPs ; do nslookup of youtube and check/note the IP adresses. Do named ACL with these IP.

It is not dynamic theis method you should check IPs regularly.

[rk6171485]

pls share the completed solution with command

[MHM Cisco World]

https://askit.ro/solutii/block-youtube-via-acl-access-control-list-in-cisco-router/

Hope this work for SW also.

MHM

[Joseph W. Doherty]

A couple of possible (?) issues, with your reference's suggestions.

I thought when you use host names in ACLs, they only get resolved at the time of ACE entry.(??)

Also, many websites, now a days, use https, not just http.  I.e. blocking just port 80 might be insufficient.

[Flavio Miranda]

Hi @rk6171485 

 This is not possible and, if possible, not recommended. L3 switch is meant to be routing and switch. If you need to block content you need a proxy.

YouTube have tons of domains and tons of IP address and sooner or later you end up seing traffic for that site. Furthermore,  FQDN ACL that could be an auternative, can increase the CPU usage and impact your device on what it needs to do which is routing and switching.

[M02@rt37]

hello @Flavio Miranda,

"can increase the CPU usage and impact your device on what it needs to do which is routing and switching."

You're right but depend on the L3SW in this case.

[Joseph W. Doherty]

As already described, you can block all the IPs associated with Youtube.  Also as noted, IPs likely to change from time to time, so you would need to keep on top of this.

Depending on you control over your DNS, for your internal systems, you could block DNS resolution for Youtube.

Whether blocking IPs and/or DNS resolution, someone "clever" might use an "anonymizer" site to access Youtube.