Ironport WSA - How can I unblock certain parts of a domain that is blocked for all users?

[Anthony Moore]

I'm trying to figure out if there's a way to block a specific domain for all users - in this case reddit.com - but unblock certain subreddits for some users.  We have a group of users with a business need to be able to view some development specific subreddits, but I don't see a way in our WSA to allow just the specific page(s).

Thanks in advance.

[Tim Schneider]

You can block it via Custom URL Blacklist for all users.

As for the problem with specific subreddits for some users:

You can define a custom URL List for the subreddits you want to unlock. Then create an "Identity" to match the Users and bind the custom URL list to this Identity.

Afterwards, create an "Access Policy" and under "Identities and Users", select "Selected Groups and Users" and add the users for which you want to unlock subreddits.

This creates the following scenario: User X hits reddit.com/r/cisco, it matches the Identity with the specific custom URL list. It goes into the Access Policy and checks if X is matched on the "selected Groups and Users". If successful, User X can browse the subreddit.

Hope this helps!

[Anthony Moore]

Thanks for the response.  We already have several Custom URL lists for our different departments.  Reddit.com is blocked via Custom URL list and AVC.  I thought that you could only list an IP, domain, or sub-domain (google.com or mail.google.com) in a Custom URL list, but not individual pages of a site (to use your example - reddit.com/r/cisco).  The latter has never worked for us.  I wish it did.

[Tim Schneider]

Have you tried regex?