Hi Jon,

Thanks for the response. My initial problem with ACL was that I had to be searching for all possible IP addresses for specific websites, which was near impossible to get them all.

I will try thri out and let you know how it goes.

However, what is EEM and could you give me an idea of a script that you are referring to?

Access is supposed to be blocked to specific websites and not the whole internet actually.

Regards,

Femi

Femi

EEM is the Embedded Event Manager which allows you to add your own bits of "code" to the router to enhance it's functionality. Funnily enough you are in the right forum here because the expert on EEM is Joe Clarke who hangs out in this forum. EEM uses TCL as a script language.

As for the script. Well before EEM and still now in fact you can write scripts in Perl/TCL etc. that can login to routers/switches and execute a series of commands. With TCL you use Expect. With Perl there is an Expect module and also a Net::Telnet::Cisco module written specifically to connect to Cisco routers/switches. You could then run this script from a windows or unix box using cron for example. Unix usually works a lot better !!

If you are looking to block access to specific websites based on their URLs and the time etc. you may want to look at more specific solutions such as Websense which is geared towards this sort of thing.

Jon

Hi Jon,

So I guess EEM would be like an add on. I tried reading up on it, but didn't quite get much from it.

I have visited the WebSense website and requested a quote. It seems to me like a 'proxy' service, which implies I would have to route internet traffic through the server that this app will sit on. I was initially avoiding this option but I guess it may be the way out...Considering its got a GUI, it should make it easier to manage as opposed to the script writing...

Regards,

Femi

EEM is not an add-on. It's already built into IOS. Your version of code supports EEM 3.0, so you have a lot of power in what you can do. In fact, Tcl won't even be required. If you wanted to be brutish about it, you could have two EEM policies that take down the Internet interface and bring it back up at specified times.

For example, say your Internet interface is Serial0/0. The following two EEM applets will shut this interface down at 18:30 (6:30 pm), and bring it back up at 07:30 (7:30 am):

event manager environment interface_intf Serial0/0

event manager applet shutdown-internet

event timer cron cron-entry "30 18 * * *"

action 1.0 cli command "enable"

action 2.0 cli command "config t"

action 3.0 cli command "interface $internet_intf"

action 4.0 cli command "shut"

action 5.0 cli command "end"

action 6.0 syslog msg "Interface $internet_intf shutdown"

event manager applet restore-internet

event timer cron cron-entry "30 7 * * *"

action 1.0 cli command "enable"

action 2.0 cli command "config t"

action 3.0 cli command "interface $internet_intf"

action 4.0 cli command "no shut"

action 5.0 cli command "end"

action 6.0 syslog msg "Internet connection restored"