Cisco ASA 5510: Blocking access by domain name
Was requested to block domains to a certain group of users. This is the code I use on my Cisco 5510 IOS 7.2(2) to block facebook.com
! define the domains that you want to block
regex domain1 "\.facebook\.com"
regex domain2 "facebook\.com"
! identify the users' IP addresses. ie, the users you want to block
! if you want to block all, replace 'host 192.168.0.x' with 'any'
access-list inside_mpc extended permit tcp host 192.168.0.100 any eq www
access-list inside_mpc extended permit tcp host 192.168.0.101 any eq www
class-map type regex match-any DomainBlockList
match regex domain1
match regex domain2
class-map type inspect http match-all BlockDomainsClass
match request header host regex class DomainBlockList
class-map inspection_default
match default-inspection-traffic
class-map httptraffic
match access-list inside_mpc
policy-map type inspect http http_inspection_policy
parameters
protocol-violation action drop-connection
match request method connect
drop-connection log
class BlockDomainsClass
reset log
policy-map inside-policy
class httptraffic
inspect http http_inspection_policy
service-policy inside-policy interface inside
Comments
Post a Comment