Cisco Content Filtering

d.junaedi · ‎11-15-2011

Hi All,

Need help with setting up Web Filtering on Cisco881 sec K9 router using CCP.

At the moment every user on the domain got blocked by the rule that i set up on the Web Filter (just using the wizard and choose default category). What i want is to separate users so that specific user can have full access while other user get filtered by the category.

And Yes I want to configure this using CCP.

Thanks.

d.junaedi · ‎11-21-2011

No one can help me here?

Is this possible or not?

cadet alain · ‎11-22-2011

Hi,

Most people here rarely if ever use CCP to configure devices.

Can you post the show run output to see which feature in IOS this is referring to, if it is using NBAR and url filtering with MQC approach then yes this can be done but on an IP address basis or even a MAC address basis but I have to verify if I'm correct concerning the MAC filtering.

Regards.

Alain

Don't forget to rate helpful posts.

d.junaedi · ‎11-29-2011

Running Config as follow

Building configuration...

Current configuration : 18052 bytes

!

! Last configuration change at 11:26:14 PCTime Tue Nov 8 2011 by abi

!

version 15.0

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname cisco881

!

boot-start-marker

boot-end-marker

!

security authentication failure rate 3 log

security passwords min-length 6

logging buffered 51200

logging console critical

enable secret 5 $1$W82K$v3PYL6rJccXNdRk5FLDfE.

!

no aaa new-model

!

memory-size iomem 10

clock timezone PCTime 7

!

crypto pki trustpoint TP-self-signed-877078919

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-877078919

revocation-check none

rsakeypair TP-self-signed-877078919

!

crypto pki trustpoint Equifax_Secure_CA

revocation-check none

!

crypto pki trustpoint NetworkSolutions_CA

revocation-check none

!

crypto pki trustpoint trps1_server

revocation-check none

!

crypto pki certificate chain TP-self-signed-877078919

certificate self-signed 01

30820246 308201AF A0030201 02020101 300D0609 2A864886 F70D0101 04050030

30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274

69666963 6174652D 38373730 37383931 39301E17 0D313131 31303330 39333530

335A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F

532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3837 37303738

39313930 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100

AC49B79B 032F803C 4A4655B1 03CDF8E2 35552118 99FD6B71 92D38693 42C3900F

2CCABDA6 081EA67F F4CEBC64 CFF0B6EA 92288021 8FB4C49D FEA21672 EBE45AB3

28D35F8C A1791216 86C0EA9D E86CA234 39A379BE 25B074A1 679133E1 35C9AE80

C5867CBD 88E3F74E EADB6C83 F81918F1 39EB1113 7001F8AC 2A6F1931 87E359FF

02030100 01A37030 6E300F06 03551D13 0101FF04 05300301 01FF301B 0603551D

11041430 12821063 6973636F 3838312E 6162692E 636F6D30 1F060355 1D230418

30168014 D01194C8 B0CEC132 D759BB38 AA876854 F2C15576 301D0603 551D0E04

160414D0 1194C8B0 CEC132D7 59BB38AA 876854F2 C1557630 0D06092A 864886F7

0D010104 05000381 81006CE3 9535330C 12404E5E D4D44DAE BD75FC35 FD02B611

5F16E1F5 C51E9E9A 7BA6F145 586A99A1 2B195F2F 7C4400CB 2BE66BC2 9C97182F

146F5C9C D602AFB0 B577537D 0631BAC9 F5522492 13D07E16 8ACFBCBF BCDA7923

3872EDD4 2AE9E291 31297983 52A216DD DDFA2E4A 43FC34A4 FF2202C0 2F33C387

4AFCE0C5 8FEA07E8 B3EB

quit

crypto pki certificate chain Equifax_Secure_CA

certificate ca 35DEF4CF

30820320 30820289 A0030201 02020435 DEF4CF30 0D06092A 864886F7 0D010105

0500304E 310B3009 06035504 06130255 53311030 0E060355 040A1307 45717569

66617831 2D302B06 0355040B 13244571 75696661 78205365 63757265 20436572

74696669 63617465 20417574 686F7269 7479301E 170D3938 30383232 31363431

35315A17 0D313830 38323231 36343135 315A304E 310B3009 06035504 06130255

53311030 0E060355 040A1307 45717569 66617831 2D302B06 0355040B 13244571

75696661 78205365 63757265 20436572 74696669 63617465 20417574 686F7269

74793081 9F300D06 092A8648 86F70D01 01010500 03818D00 30818902 818100C1

5DB15867 0862EEA0 9A2D1F08 6D911468 980A1EFE DA046F13 846221C3 D17CCE9F

05E0B801 F04E34EC E28A9504 64ACF16B 535F05B3 CB6780BF 42028EFE DD0109EC

E100144F FCFBF00C DD43BA5B 2BE11F80 70991557 9316F10F 976AB7C2 68231CCC

4D5930AC 511E3BAF 2BD6EE63 457BC5D9 5F50D2E3 500F3A88 E7BF14FD E0C7B902

03010001 A3820109 30820105 30700603 551D1F04 69306730 65A063A0 61A45F30

5D310B30 09060355 04061302 55533110 300E0603 55040A13 07457175 69666178

312D302B 06035504 0B132445 71756966 61782053 65637572 65204365 72746966

69636174 65204175 74686F72 69747931 0D300B06 03550403 13044352 4C31301A

0603551D 10041330 11810F32 30313830 38323231 36343135 315A300B 0603551D

0F040403 02010630 1F060355 1D230418 30168014 48E668F9 2BD2B295 D747D823

20104F33 98909FD4 301D0603 551D0E04 16041448 E668F92B D2B295D7 47D82320

104F3398 909FD430 0C060355 1D130405 30030101 FF301A06 092A8648 86F67D07

4100040D 300B1B05 56332E30 63030206 C0300D06 092A8648 86F70D01 01050500

03818100 58CE29EA FCF7DEB5 CE02B917 B585D1B9 E3E095CC 25310D00 A6926E7F

B692639E 5095D19A 6FE411DE 63856E98 EEA8FF5A C8D355B2 667157DE C021EB3D

2AA72349 01048642 7BFCEE7F A21652B5 6767D340 DB3B2658 B228773D AE147761

D6FA2A66 27A00DFA A7735CEA 70F19421 65445FFA FCEF2968 A9A28779 EF79EF4F AC077738

quit

crypto pki certificate chain NetworkSolutions_CA

certificate ca 10E776E8A65A6E377E050306D43C25EA

308204A6 3082038E A0030201 02021010 E776E8A6 5A6E377E 050306D4 3C25EA30

0D06092A 864886F7 0D010105 05003081 97310B30 09060355 04061302 5553310B

30090603 55040813 02555431 17301506 03550407 130E5361 6C74204C 616B6520

43697479 311E301C 06035504 0A131554 68652055 53455254 52555354 204E6574

776F726B 3121301F 06035504 0B131868 7474703A 2F2F7777 772E7573 65727472

7573742E 636F6D31 1F301D06 03550403 13165554 4E2D5553 45524669 7273742D

48617264 77617265 301E170D 30363034 31303030 30303030 5A170D32 30303533

30313034 3833385A 3062310B 30090603 55040613 02555331 21301F06 0355040A

13184E65 74776F72 6B20536F 6C757469 6F6E7320 4C2E4C2E 432E3130 302E0603

55040313 274E6574 776F726B 20536F6C 7574696F 6E732043 65727469 66696361

74652041 7574686F 72697479 30820122 300D0609 2A864886 F70D0101 01050003

82010F00 3082010A 02820101 00C3DD36 CC83C318 55B096D9 1325D326 864838BB

167FF19F 29F6FD03 F1ED4D26 9A56F0B5 1A1ACDE6 CC855540 A4B5D00D CA22EF3D

23C67E6C CCBCA1E9 7C5046E0 BD14AD65 12C20B11 69520A07 921F736F C1BAD762

F0CE002E 34A5C8E6 2F0FEC0D EA446175 68E5E4DC 80364FDA 785D5325 9494F54F

2E3A606F 0CA6D9B3 F62A2E03 12D52642 0751B264 5771DC21 1C89C769 A3E6FBC2

7B6EEF0C 87FB5064 E84E4BEF E7719B83 6361C932 8D8CEC14 A7E489AD 3F2B2664

E48542F2 8950E13A BE15E345 25E25ACB 8C3FE033 1E35095A 84EA7E5D A1F59180

0A2806B7 CB314125 618B01E9 56A2F63E 5F2FF3C4 43F61994 75834CA1 82423AC6

BAC40930 A6E17502 51B95E64 8B020301 0001A382 01203082 011C301F 0603551D

23041830 168014A1 725F261B 28984395 5D0737D5 85969D4B D2C34530 1D060355

1D0E0416 04143C41 E28F0808 A94C2589 8D6DC538 D0FC858C 6217300E 0603551D

0F0101FF 04040302 01063012 0603551D 130101FF 04083006 0101FF02 01003019

0603551D 20041230 10300E06 0C2B0601 0401860E 01020103 01304406 03551D1F

043D303B 3039A037 A0358633 68747470 3A2F2F63 726C2E75 73657274 72757374

2E636F6D 2F55544E 2D555345 52466972 73742D48 61726477 6172652E 63726C30

5506082B 06010505 07010104 49304730 4506082B 06010505 07300286 39687474

703A2F2F 7777772E 75736572 74727573 742E636F 6D2F6361 63657274 732F5554

4E416464 54727573 74536572 7665725F 43412E63 7274300D 06092A86 4886F70D

01010505 00038201 010068AB FCEF806B 18B2B0B3 A34589CB 53C5A2E6 AF08A9FD

FF0F49AC FFE49FD7 417CA3C5 A2E8AAE0 57212DC3 AA7C0C4C 280B79F4 EE4C32AD

790E7EA2 5E34184F DF54F1BD 687CE3D3 D7465E6D 64C2F76D 8882730C EF9985EA

A9EF324A F0839F73 910CA43E 2B3151A6 628F1584 F9A63A12 303FDA6E F8CCC719

920F5CF4 FE17F195 0847522C 508FE89B A5EEAE70 33899182 FE30AA76 7659D76C

18D32B12 5B1D281D 7871F6CD 36A2E907 48443BE7 576E820A ADC58ADD E853B471

AF13D206 9D376D53 3F8A3508 FAFEA216 E6B96F5C 5639D6C6 AAEF1967 CE13C5B8

9505FB0A 44C99FA9 40254B32 11AF07FE 08D54271 E9E1538B 151FDD2A 07957024

6F645ED3 B7902E8B 21D8

quit

crypto pki certificate chain trps1_server

certificate ca 00

3082029F 30820208 02010030 0D06092A 864886F7 0D010104 05003081 97310B30

09060355 04061302 55533111 300F0603 55040813 08436F6C 6F726164 6F311030

0E060355 04071307 426F756C 64657231 16301406 0355040A 130D4369 73636F20

53797374 656D7331 0C300A06 0355040B 13035354 47311D30 1B060355 04031314

74727073 312D626C 64722E63 6973636F 2E636F6D 311E301C 06092A86 4886F70D

01090116 0F777473 75694063 6973636F 2E636F6D 301E170D 30363130 32333230

32363231 5A170D30 39303731 39323032 3632315A 30819731 0B300906 03550406

13025553 3111300F 06035504 08130843 6F6C6F72 61646F31 10300E06 03550407

1307426F 756C6465 72311630 14060355 040A130D 43697363 6F205379 7374656D

73310C30 0A060355 040B1303 53544731 1D301B06 03550403 13147472 7073312D

626C6472 2E636973 636F2E63 6F6D311E 301C0609 2A864886 F70D0109 01160F77

74737569 40636973 636F2E63 6F6D3081 9F300D06 092A8648 86F70D01 01010500

03818D00 30818902 818100BF F80B7E13 19C5AA37 D7433EDC 4EC5CAD8 40BEE950

7C099395 997043C9 B9C4BCF6 DF97F091 0ECB7D06 F1B336C6 CD134A67 826B0182

09535A4B 11EB4BE8 B46187CB BBD9FECB CB03AE65 8F2C5E7E 40A66FF2 899E2FF1

CBC072B2 A9B537C0 84C9F873 8A141ED9 D8D15186 F7047400 BB8A2CA1 C59DEAD8

DA09FBB3 6E67D8BF F6811102 03010001 300D0609 2A864886 F70D0101 04050003

818100AC C6185869 1324F6BD 728A8D00 CEDF15E3 14671016 90ED8F7B 5FF72860

8F9469D2 B344641D 75E4A566 BCB06ACE 21DFC2B3 041A961C 8A23610A 284BC399

8E632BBA C734D76A 266E6A45 88DC366F C5E12E9E 087AC3AA 7FEE2089 C97821A7

882BFEC3 26425299 11700277 B9E4EBCD 15A0B388 F8D4A102 E472A398 63E0D7DA 5BFBE1

quit

no ip source-route

!

ip cef

no ip bootp server

ip domain name abi.com

ip name-server 192.168.2.10

no ipv6 cef

!

multilink bundle-name authenticated

parameter-map type urlfpolicy trend cptrendparacatdeny0

allow-mode on

block-page message "The website you have accessed is blocked as per corporate policy"

parameter-map type urlfpolicy trend cptrendparacatdeny1

allow-mode on

block-page message "The website you have accessed is blocked as per corporate policy"

parameter-map type urlf-glob cpaddbnwlocparapermit0

pattern facebook.com

parameter-map type urlf-glob cpeditbnwlocparadeny1

parameter-map type urlf-glob cpaddkblocpara2

pattern twitter

parameter-map type urlf-glob cpaddbnwlocparadeny3

pattern facebook.com

parameter-map type trend-global global-param-map

license udi pid CISCO881-SEC-K9 sn FGL1516272A

!

username abi privilege 15 secret 5 $1$9KCH$sWZmMke.TWMjT5d9njuV/1

!

ip tcp synwait-time 10

ip ssh time-out 60

ip ssh authentication-retries 2

!

class-map type inspect match-any SDM_BOOTPC

match access-group name SDM_BOOTPC

class-map type inspect match-any FULLINET

match protocol http

match protocol https

class-map type inspect match-any SDM_DHCP_CLIENT_PT

match class-map SDM_BOOTPC

class-map type inspect match-any sdm-cls-bootps

match protocol bootps

class-map type inspect match-any ccp-cls-insp-traffic

match protocol cuseeme

match protocol dns

match protocol ftp

match protocol h323

match protocol https

match protocol icmp

match protocol imap

match protocol pop3

match protocol netshow

match protocol shell

match protocol realmedia

match protocol rtsp

match protocol smtp

match protocol sql-net

match protocol streamworks

match protocol tftp

match protocol vdolive

match protocol tcp

match protocol udp

class-map type inspect match-all ccp-insp-traffic

match class-map ccp-cls-insp-traffic

class-map type urlfilter match-any cpaddbnwlocclasspermit0

match server-domain urlf-glob cpaddbnwlocparapermit0

class-map type urlfilter match-any cpaddbnwlocclassdeny3

match server-domain urlf-glob cpaddbnwlocparadeny3

class-map type inspect match-any -sdminspectclassmap-1

match protocol http

class-map type inspect match-any ccp-cls-icmp-access

match protocol icmp

match protocol tcp

match protocol udp

class-map type urlfilter trend match-any cptrendclasscatdeny0

match url category Chat-Instant-Messaging

match url category Nudity

match url category Pornography

match url category Social-Networking

match url category Abortion

match url category Activist-Groups

match url category Adult-Mature-Content

match url category Alcohol-Tobacco

match url category Gambling

match url category Games

match url category Gay-Lesbian

match url category Internet-Radio-and-TV

match url category Internet-Telephony

match url category Intimate-apparel-swimsuit

match url category Joke-Programs

match url category Marijuana

match url category Military

match url category Personals-Dating

match url category Sex-education

match url category Spam

match url category Weapons

match url category Violence-hate-racism

class-map type urlfilter trend match-any cptrendclasscatdeny1

match url category Adult-Mature-Content

match url category Chat-Instant-Messaging

match url category Gambling

match url category Marijuana

match url category Nudity

match url category Pornography

match url category Social-Networking

match url category Violence-hate-racism

class-map type urlfilter match-any cpaddkblocclass2

match url-keyword urlf-glob cpaddkblocpara2

class-map type urlfilter trend match-any cptrendclassrepdeny1

match url reputation ADWARE

match url reputation DIALER

match url reputation DISEASE-VECTOR

match url reputation HACKING

match url reputation PASSWORD-CRACKING-APPLICATIONS

match url reputation PHISHING

match url reputation POTENTIALLY-MALICIOUS-SOFTWARE

match url reputation SPYWARE

match url reputation VIRUS-ACCOMPLICE

class-map type urlfilter trend match-any cptrendclassrepdeny0

match url reputation ADWARE

match url reputation DIALER

match url reputation DISEASE-VECTOR

match url reputation HACKING

match url reputation PASSWORD-CRACKING-APPLICATIONS

match url reputation PHISHING

match url reputation POTENTIALLY-MALICIOUS-SOFTWARE

match url reputation SPYWARE

match url reputation VIRUS-ACCOMPLICE

class-map type urlfilter match-any cpeditbnwlocclassdeny1

match server-domain urlf-glob cpeditbnwlocparadeny1

class-map type inspect match-all ccp-icmp-access

match class-map ccp-cls-icmp-access

class-map type inspect match-all ccp-invalid-src

match access-group 100

class-map type inspect match-all ccp-protocol-http

match protocol http

!

policy-map type inspect ccp-permit-icmpreply

class type inspect sdm-cls-bootps

pass

class type inspect ccp-icmp-access

inspect

class class-default

pass

policy-map type inspect urlfilter cppolicymap-1

parameter type urlfpolicy trend cptrendparacatdeny0

class type urlfilter cpaddbnwlocclassdeny3

reset

log

class type urlfilter trend cptrendclasscatdeny0

reset

log

class type urlfilter trend cptrendclassrepdeny0

reset

log

policy-map type inspect ccp-inspect

class type inspect ccp-invalid-src

drop log

class type inspect ccp-protocol-http

inspect

service-policy urlfilter cppolicymap-1

class type inspect ccp-insp-traffic

inspect

class class-default

drop

policy-map type inspect ccp-permit

class type inspect SDM_DHCP_CLIENT_PT

pass

class class-default

drop

policy-map type inspect urlfilter cppolicymap-2

parameter type urlfpolicy trend cptrendparacatdeny1

class type urlfilter trend cptrendclasscatdeny1

reset

log

class type urlfilter trend cptrendclassrepdeny1

reset

log

policy-map type inspect ccp-policy-ccp-cls--1

class type inspect -sdminspectclassmap-1

inspect

service-policy urlfilter cppolicymap-2

class class-default

drop

!

zone security out-zone

zone security in-zone

zone security ccp-inet

zone-pair security ccp-zp-self-out source self destination out-zone

service-policy type inspect ccp-permit-icmpreply

zone-pair security ccp-zp-in-out source in-zone destination out-zone

service-policy type inspect ccp-inspect

zone-pair security ccp-zp-out-self source out-zone destination self

service-policy type inspect ccp-permit

zone-pair security sdm-zp-ccp-inet-out-zone source ccp-inet destination out-zone

service-policy type inspect ccp-policy-ccp-cls--1

!

interface FastEthernet0

!

interface FastEthernet1

!

interface FastEthernet2

!

interface FastEthernet3

!

interface FastEthernet4

description $ES_WAN$$FW_OUTSIDE$

ip address dhcp client-id FastEthernet4

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat outside

ip virtual-reassembly

zone-member security out-zone

duplex auto

speed auto

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$

ip address 192.168.2.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly

zone-member security in-zone

ip tcp adjust-mss 1452

!

ip forward-protocol nd

ip http server

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

ip nat inside source list 1 interface FastEthernet4 overload

!

ip access-list extended SDM_BOOTPC

remark CCP_ACL Category=0

permit udp any any eq bootpc

!

logging trap debugging

access-list 1 remark INSIDE_IF=Vlan1

access-list 1 remark CCP_ACL Category=2

access-list 1 permit 192.168.2.0 0.0.0.255

access-list 100 remark CCP_ACL Category=128

access-list 100 permit ip host 255.255.255.255 any

access-list 100 permit ip 127.0.0.0 0.255.255.255 any

no cdp run

!

control-plane

!

banner exec ^CC