Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ACL for url

Hi all,

I wish to block some url that users have access through my LAN

Thats i wish to block icmp,access towards such sites, i wish to block icmp because dns will resolve the domain and they can access through ip address.

what i have in place is a cisco 2800 series routers,

Can someone help me out

Thanks

7 REPLIES

ACL for url

Hi Divine,

I you have VLAN's in your LAN then you can define access-list like below and apply under the specific vlan.
First you need to get the websites IP's then use those in access-lists


ip access-list ext urlblock
deny tcp any host website-ip eq icmp
permit ip any any

Like wise you can put the number of website IP's in the same order. Now apply the access-list to specific vlan interface.

int vlan 10
ip address 192.168.1.10 255.255.255.0
ip access-group urlblock in

Hope the above clear and understand you. Please let us know if you have any doubts still.


Please rate all the helpfull posts.
Regards,
Naidu.

New Member

ACL for url

Hi,

yes correct, but i have a problem of assembling all this sites

Can i have a help on this

Thanks

ACL for url

****but i have a problem of assembling all this sites***

Can you please aloberate it?

What do you mean assembling all this sites?

If you want to block some of the sites you need to know those sites address like www.facebook.com and its IP is (69.171.229.11) if you try to ping the website address then you can get to know the IP belongs to that website, so you can write the access-list rule accordingly.

ip access-list ext urlblock

deny tcp any host 69.171.229.11 eq icmp

permit ip any any

Hope the above clear and understand you. Please let us know if you have any doubts still.


Please rate all the helpfull posts.
Regards,
Naidu.

Bronze

Re: ACL for url

Hi,

If you don't use pings to test connectivity outside your lan, you can change the ACL statement Naidu wrote to block all icmp

access-list 100 deny tcp any any eq icmp

access-list 100 permit ip any any

You can apply this ACL on the router's LAN interface

Example:

  interface Fa0/0

  ip access-group 100 in

Also check this article as well

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/access_filter.html#wp1045692

Hope this helps

Eugen

PS. other option is to use a proxy server and have all users in the LAN go through the proxy to the internet.

New Member

ACL for url

Hi,

I understand, but you see there are alot of social network sites.

How can i assemble all if not the must of them

Thanks

ACL for url

Hi Divine,

If you dont know all the social network sites to which you want block icmp then your options are...

1. You can start define the access-list with known websites, later on you can add if something notified by you.
2. Try to know your LAN network ranges like all other your business network, so that we can allow icmp to those networks and block rest of networks.
3. Block icmp completely from the respective vlan. It will block to everyone. This option you can choose when you no need to ping any other network (remember it will block only icmp rest of things will be work as it is)

Hope the above clear and understand you.


Please rate all the helpfull posts.
Regards,
Naidu.

Cisco Employee

ACL for url

When you want to block multiple sites, use sequence numbers (in the same access list)  and you can put multiple statements as suggested in the above post and apply this ACL in the appropriate interfaces.

ofcourse, you have to know the ip address of each of the destinations to block access to those sites.. I dont know if there is a better way of doing that w/o the ip address.

-Vijay

614
Views
0
Helpful
7
Replies
CreatePlease login to create content