Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Restriction of Web Sites

Greetings, All.

Due to a *very* stringent security policy, the users behind a specific ASA 5505 (v 8.04) will only be allowed to access a limited number of web sites. For simplicities sake, let's just say they can only access and, and nothing else.

I've monkeyed with the configs a bit and haven't had any luck. I've attached the config with which I've tried to make this happen. Perhaps I'm close? Is my access list jacked? With this config, everything is blocked...including espn and yahoo. Not exactly what I want.

URL filtering is not an option as WebSense will be too costly.

I do know that you can keep users from visiting specific sites (gambling, porn, etc;), but what if you want to keep the users from visiting any site except maybe 1 or 2?

Thanks in advance.

New Member

Re: Restriction of Web Sites

I believe you can only block certain websites, rather than allow certain websites, therefore regexp is no use to you really.

REGEXP config example here:

Only other option (and it costs) is to purchase a CSC-SSM module. More info here:

Good luck :-)

Re: Restriction of Web Sites

You can limit where people go with regex and class maps. I have a handful of users that are only allowed to go to certain sites, and here's what I did:

Create your acl:

access-list RESTRICTED permit ip host any

Match that ACL:

class-map RESTRICTED

match access-list RESTRICTED

Create your regex:

regex espn "\.espn\.com"

Create your regex class-map:

class-map type regex match-any Internet_Allowed

match regex espn

Inspect the regex class map, but only allow what DOESN'T match:

class-map type inspect http match-all INTERNET_RESTRICTED

match not request header host regex class Internet_Allowed

Create a policy map to perform actions on above:

policy-map type inspect http RESTRICTED_INTERNET


reset log

(The reset above will reset any connection that DOESN'T match your regex. It allows only

Then create a policy to apply to the inside interface:

policy-map INSIDE



(The class above matches the acl for your hosts, and the it applies the other policy map RESTRICTED_INTERNET to scan against your acl.)



HTH, John *** Please rate all useful posts ***
CreatePlease login to create content