I suggest running the scenario through Dynamips and PEMU for test purposes so you don't affect production traffic.
AFAIK, the configuration unfortunately doesn't really get simpler than what the URL provided. Out of the box URL filtering requires RegEx and an MPF configuration. Regarding a question on possible action only being "block/reset/ log". That is true. However, you can use a negative condition to "permit" what you want with "match not" in your http inspection class-map. While I have not specifically used MPF for http blocking, I have used it for FTP. The example below is an example of only permitting a certain filename to be retrieved via FTP while denying everything else. Yes I'm aware that it's an FTP example, but the same basic logic should/would apply for any other type of traffic which can be inspected. regex SymPtrn2 "minitri\.flg" class-map type regex match-any cls-symantec-files match regex SymPtrn2 class-map type inspect ftp match-all cls-deny-ftp match not filename regex class cls-symantec-files class-map ftp-traffic match port tcp eq ftp policy-map type inspect ftp checkftp parameters class cls-deny-ftp reset log policy-map mondmz-policy class ftp-traffic inspect ftp strict checkftp service-policy mondmz-policy interface mondmz Vijay Ramcharan From: Bunny Singh [mailto:[email protected]] Sent: Friday, March 19, 2010 9:55 AM To: [email protected]; Ramcharan, Vijay A Subject: Re: [c-nsp] Cisco asa5550 url filter Hi Vijay, Thanks for the reply, I have checked and try to do but facing issue as the example given is too complicated and its difficult to do the test on the production Environment, Can you share a example to allowing the access for a single site. I am very thankfull to you. Regards Bunny --- On Fri, 3/19/10, Ramcharan, Vijay A <[email protected]> wrote: From: Ramcharan, Vijay A <[email protected]> Subject: Re: [c-nsp] Cisco asa5550 url filter To: [email protected] Date: Friday, March 19, 2010, 1:24 PM Try Google or Bing with search string "asa inspect http regex" The example given below is for blocking certain websites but you should be able to come up with a configuration that only allows certain sites and block everything else. http://www.cisco.com/en/US/products/ps6120/products_configuration_exampl e09186a0080940e04.shtml Vijay Ramcharan -----Original Message----- From: [email protected] <http://us.mc450.mail.yahoo.com/mc/[email protected] her.net> [mailto:[email protected] <http://us.mc450.mail.yahoo.com/mc/[email protected] her.net> ] On Behalf Of Bunny Singh Sent: Friday, March 19, 2010 7:39 AM To: [email protected] <http://us.mc450.mail.yahoo.com/mc/[email protected]> Subject: [c-nsp] Cisco asa5550 url filter Hi, We are using Cisco asa5550, and i want to put a url based acl/filteration for the particular client. We have one client on inside interface who needs the access of www.youtube.com only(outside interface) and to restrict the same we are not able to restrict through IP acl's as Youtube ip's are changing periodically. So is it any way to put a http url filter to open only a single desired site and else will be denied. Regards DJ Singh _______________________________________________ cisco-nsp mailing list [email protected] <http://us.mc450.mail.yahoo.com/mc/[email protected]> https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] <http://us.mc450.mail.yahoo.com/mc/[email protected]> https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ______________________________________________________________________ This e-mail has been scanned by Verizon Managed Email Content Service, using Skeptic(tm) technology powered by MessageLabs. For more information on Verizon Managed Email Content Service, visit http://www.verizonbusiness.com. ______________________________________________________________________ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
