Modular Policy Framework (ASA)
Productivity increase by blocking non-project related sites is one of the myth that I’ve seen a lot on various online forums and as well there are always counter research data as to this has nothing to do with ‘increase in productivity’. I guess, I kinda agree too (Well, I know one of the leading IT companies who doesn’t give computers with internet access to any employee and only the lead/manager has it, that too restricted).
So putting aside the arguments, one of the issues with blocking outgoing connections based on IP has always failed (imagine the cloud of servers, if you were to block say yahoo mail). Now the Modular Policy Framework does support regex checking in the URL header to see which site it is going and block it, if you’d like to.
Here is the Cisco article describing the MPF in details {Here}
Now how do you block say access to facebook or myspace, from being utilized by your employees?? Pete has a good write-up on it and hence I’m not going to write it again here.
In short the configuration you need is; Thanks to Pete for providing such a detailed write-up.
On the Global Policy
————————————————-regex domainlist1 "facebook.com"
class-map type regex match-any DomainBlockList
match regex domainlist1
class-map type inspect http match-all BlockDomainsClass
match request header host regex class DomainBlockList
policy-map type inspect http http_inspection_policy
class BlockDomainsClass
reset log
policy-map global_policy
class inspection_default
inspect http http_inspection_policy
service-policy global_policy global
———————————————-With its own policy
———————————————–
regex BLOCKED_DOMAIN_1 "www.facebook.com"
access-list TRAFFIC_TO_INSPECT_FOR_BLOCKED_DOMAINS extended permit tcp any any eq http
class-map type regex match-any CLASS_MAP_BLOCKED_DOMAIN_LIST
match regex BLOCKED_DOMAIN_1
class-map type inspect http match-all CLASS_MAP_DEFINE_TRAFFIC_TO_INSPECT
match request header host regex class CLASS_MAP_BLOCKED_DOMAIN_LIST
class-map CLASS_MAP_HTTP_TRAFFIC
match access-list TRAFFIC_TO_INSPECT_FOR_BLOCKED_DOMAINS
policy-map type inspect http POLICY_MAP_HTTP_INSPECTION
parameters
class CLASS_MAP_DEFINE_TRAFFIC_TO_INSPECT
drop-connection log
policy-map POLICY_MAP_OUTSIDE_INTERFACE
class CLASS_MAP_HTTP_TRAFFIC
inspect http POLICY_MAP_HTTP_INSPECTION
service-policy POLICY_MAP_OUTSIDE_INTERFACE interface outside
), he actually asked a guy to give some basic test cases for a cell phone/Mobile phone. So he gave some ‘not-so-satisfying’ test scenarios. So my friend asked him to write down a stress test case for this phone and the candidate mentioned that he will “Make a long distance call” and that was a stress test case for him. See the thinking has to be aligned if not exactly correct. Once a CCIE guy was just goofing around, since he only had teaching experience and never touched a live network in his life, so I was frustrated with this answers (C’mon if a router doesn’t respond, he’d just reboot it seems!) and so was my other fellows listening to it. So I asked him to subnet a network and asked him to use the white-board since he’d be more comfortable that way since he was a network teacher/instructor. He did something and came down on something silly as 90/2 is approximately 40. I was literally “DONE” with the candidate, went to my manager and asked him to just get this guy off the premises.
disable a lot of functions in Windows (Like disable the task manager, Disable registry editor etc).
2009