Restriction of Web Sites

Unanswered Question
May 15th, 2009
User Badges:

Greetings, All.

Due to a *very* stringent security policy, the users behind a specific ASA 5505 (v 8.04) will only be allowed to access a limited number of web sites. For simplicities sake, let's just say they can only access and, and nothing else.

I've monkeyed with the configs a bit and haven't had any luck. I've attached the config with which I've tried to make this happen. Perhaps I'm close? Is my access list jacked? With this config, everything is blocked...including espn and yahoo. Not exactly what I want.

URL filtering is not an option as WebSense will be too costly.

I do know that you can keep users from visiting specific sites (gambling, porn, etc;), but what if you want to keep the users from visiting any site except maybe 1 or 2?

Thanks in advance.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
handsy Fri, 05/15/2009 - 06:44
User Badges:

I believe you can only block certain websites, rather than allow certain websites, therefore regexp is no use to you really.

REGEXP config example here:

Only other option (and it costs) is to purchase a CSC-SSM module. More info here:

Good luck :-)

John Blakley Fri, 05/15/2009 - 07:46
User Badges:
  • Purple, 4500 points or more

You can limit where people go with regex and class maps. I have a handful of users that are only allowed to go to certain sites, and here's what I did:

Create your acl:

access-list RESTRICTED permit ip host any

Match that ACL:

class-map RESTRICTED

match access-list RESTRICTED

Create your regex:

regex espn "\.espn\.com"

Create your regex class-map:

class-map type regex match-any Internet_Allowed

match regex espn

Inspect the regex class map, but only allow what DOESN'T match:

class-map type inspect http match-all INTERNET_RESTRICTED

match not request header host regex class Internet_Allowed

Create a policy map to perform actions on above:

policy-map type inspect http RESTRICTED_INTERNET


reset log

(The reset above will reset any connection that DOESN'T match your regex. It allows only

Then create a policy to apply to the inside interface:

policy-map INSIDE



(The class above matches the acl for your hosts, and the it applies the other policy map RESTRICTED_INTERNET to scan against your acl.)




This Discussion