05-15-2009 06:29 AM - edited 03-11-2019 08:32 AM
Greetings, All.
Due to a *very* stringent security policy, the users behind a specific ASA 5505 (v 8.04) will only be allowed to access a limited number of web sites. For simplicities sake, let's just say they can only access www.espn.com and www.yahoo.com, and nothing else.
I've monkeyed with the configs a bit and haven't had any luck. I've attached the config with which I've tried to make this happen. Perhaps I'm close? Is my access list jacked? With this config, everything is blocked...including espn and yahoo. Not exactly what I want.
URL filtering is not an option as WebSense will be too costly.
I do know that you can keep users from visiting specific sites (gambling, porn, etc;), but what if you want to keep the users from visiting any site except maybe 1 or 2?
Thanks in advance.
05-15-2009 06:44 AM
I believe you can only block certain websites, rather than allow certain websites, therefore regexp is no use to you really.
REGEXP config example here:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940c5a.shtml
Only other option (and it costs) is to purchase a CSC-SSM module. More info here:
Good luck :-)
05-15-2009 07:46 AM
You can limit where people go with regex and class maps. I have a handful of users that are only allowed to go to certain sites, and here's what I did:
Create your acl:
access-list RESTRICTED permit ip host 192.168.1.5 any
Match that ACL:
class-map RESTRICTED
match access-list RESTRICTED
Create your regex:
regex espn "\.espn\.com"
Create your regex class-map:
class-map type regex match-any Internet_Allowed
match regex espn
Inspect the regex class map, but only allow what DOESN'T match:
class-map type inspect http match-all INTERNET_RESTRICTED
match not request header host regex class Internet_Allowed
Create a policy map to perform actions on above:
policy-map type inspect http RESTRICTED_INTERNET
class INTERNET_RESTRICTED
reset log
(The reset above will reset any connection that DOESN'T match your regex. It allows only espn.com.)
Then create a policy to apply to the inside interface:
policy-map INSIDE
class RESTRICTED
inspect http RESTRICTED_INTERNET
(The class above matches the acl for your hosts, and the it applies the other policy map RESTRICTED_INTERNET to scan against your acl.)
HTH,
John
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide