How to deny an URL instead of an IP address in ACL?

Question

Hi NG,One of my customers router is configured as a EZVPN startpoint.To collect all local subnets to forward into that VPN an ACL is setup.I'd like to exclude a specific traffic pattern from going over the VPN.Src = one single host of subnet 3dst = URLcurrently its done with the IP of the remote subnet. Due to the factthat the remote address may change i'd like to replace the remote ipsubnet by its URL.Does anyone has an idea how to do that?---snip---crypto ipsec client ezvpn US2Europeconnect autogroup group-g2 key xxxxxxxxxxxxxxxxxxxxxxxxxxxxmode network-extensionpeer x.x.x.xacl inside_networksflow restrictvirtual-interface 1username      password xxxxxxxxxauth userid mode local!!ip access-list extended inside_networkspermit ip  0.0.0.255 anypermit ip  0.0.0.255 any!deny ip host   0.0.0.255!permit ip  0.0.15.255 any---snip---tnaks for any hints.stephan

Doug McIntyre · Accepted Answer

ACL's based on IP addresses are quite a bit easier. You'll want to use the NBAR feature. Here's a pretty decent tutorial.

stephan · Answer

I played in the lab and learned this:Having a 3560 as a L3-switch and an 1800 router.I compared the ability of both to filter the URL in an ACL.First I used NBAR on the router:!class-map match-any cm_http-url match protocol http host **            !  = url!policy-map pm_http-url class cm_http-url  set ip dscp 1!manipulate. But its easy to recognize an URL with NBAR.I switches over to the L3-switch and did this:!route-map net-111 permit 10match ip address 111set ip next-hop 10.96.240.3!route-map net-111 permit 20!interface g0/1ip policy route-map net-111!access-list 111 ......conclusion: both did a good job, but not the thing i wanted.My next christmas-wish is this:a cat-IOS with this >>>commands

Rob · Answer

stephan  wrote:

How to deny an URL instead of an IP address in ACL?

Join the Discussion

Didn't find your answer?