Thanks for the reply Marius, I'll give this a try.

Hi Marius, it still allows access to ebay.com, and myspace.com, I had typos at first but I carefully followed your instructions and the commnands worked but was still allowing access to the 2 sites I wanted to block.

here' the current policy entries;

ASA Version 9.1(2)8

regex ebay "\ebay\.com"
regex myspace "\myspace\.com"

object network obj-LAN
subnet 0.0.0.0 0.0.0.0

class-map type regex match-any domain-list
match regex ebay
match regex myspace
class-map type inspect http match-all ALLOWED_URL_CLASS_MAP
match not request uri regex class domain-list
class-map inspection_default
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map type inspect http URL
parameters
class ALLOWED_URL_CLASS_MAP
  drop-connection
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global

Message was edited by: CARLO DOMINGUEZ

Hi Marius, I see so the match not command means to only allow what's on the domain-list, and then vice versa. And looks like it needs to also be put in the global policy group for it to take effect to all interfaces. I wasn't putting it in the global policy that's probably why I was having some issues when I first tried it, thanks I'll give it another try at the end of the day.

Hi Marius, I get this error when I add the class under the global policy, any ideas, thanks.

crxasa(config)# policy-map global_policy

crxasa(config-pmap)# class ALLOWED_URL_CLASS_MAP

ERROR: Specified class type is different from the policy-map type.

I forgot to add another policy map in the mix.  The below configuration should work.

regex ebay "\ebay\.com"

regex myspace "\myspace\.com"

class-map type regex match-any domain-list

match regex ebay

match regex myspace

class-map type inspect http match-all ALLOWED_URL_CLASS_MAP

match request uri regex class domain-list

policy-map type inspect http HTTP_BLOCK_POLICY

parameters

class ALLOWED_URL_CLASS_MAP

  drop-connection

policy-map global_policy

class inspection_default

  inspect http HTTP_BLOCK_POLICY

Hi Marius, thanks for the reply, but somehow it won't work, it still allows ebay and myspace, here's my config of the policies.

regex ebay "\ebay\.com"

regex myspace "\myspace\.com"

!

class-map type regex match-any domain-list

match regex ebay

match regex myspace

class-map type inspect http match-all ALLOWED_URL_CLASS_MAP

match request uri regex class domain-list

class-map inspection_default

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map type inspect http HTTP_BLOCK_POLICY

parameters

class ALLOWED_URL_CLASS_MAP

  drop-connection

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect http HTTP_BLOCK_POLICY

!

service-policy global_policy global

Can you try this.

regex url1 "[e|E][b|B][a|A][y|Y]"

regex url2 "[g|G][o|O][o|O][g|G][l|L][e|E]"

!

class-map type inspect dns match-all web_url_policy

match domain-name regex url1

match domain-name regex url2

!

policy-map type inspect dns web_policy

class web_url_policy

  drop

!

policy-map global_policy

class inspection_default

  inspect dns web_policy

!

service-policy global_policy global

Please rate replies and mark question as "answered" if applicable.

Thanks for the reply rr, I'll try this if the other ones don't work.

edit the regex entries.

regex ebay "*\.ebay\.com"

regex myspace "\.myspace\.com"

If that doesn't match, then try using the * infront of the domain.

regex ebay "*ebay\.com"

regex myspace "*myspace\.com"

Configuration looks correct, we just need to find the correct match parameter.

--

Please rate all helpful posts.

  I have another question on another command I seem to have trouble with, this is my first time hands on with ASA btw, so I'm just getting into the meat and potatoes of the asa just about over a month now.

  I read that you can group together udp and tcp, so I did that with grouping smtp, http. https. and domain to a set of host objects, but email won't go through, I think http worked though but somehow smtp won't unless I seperate it on one line. Any ideas?

Could you post the group objects in question as well as the access list you are using them in.  The following would is an example of how you would configure it.

object-group service SERVICES tcp

port-object eq http

port-object eq https

port-object smtp

access-list MYACL extended permit tcp host 10.10.10.1 any object-group SERVICES

--

Please rate all helpful posts

Marius, thanks for the reply, I'm using the command service-object instead of port-object, I got it from my asa 2nd ed book off a sample. I'll try port-object and see what happens, it'll save me some time having to type seperate lines of command for each host.

object-group service server-services

service-object tcp destination eq www

service-object tcp destination eq https

service-object tcp destination eq smtp

access-list ACL_OUT_IN extended permit object-group server-services host 208.x.x.12 any