Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6

Adding a Webtype Access List

---

Webtype access lists are added to a configuration that supports filtering for clientless SSL VPN. This chapter describes how to add an access list to the configuration that supports filtering for WebVPN.

This chapter includes the following sections:

• Licensing Requirements for Webtype Access Lists
• Guidelines and Limitations
• Default Settings
• Using Webtype Access Lists
• What to Do Next
• Monitoring Webtype Access Lists
• Configuration Examples for Webtype Access Lists
• Feature History for Webtype Access Lists

Licensing Requirements for Webtype Access Lists

The following table shows the licensing requirements for this feature:

Guidelines and Limitations

This section includes the guidelines and limitations for this feature:

• Context Mode Guidelines
• Firewall Mode Guidelines
• Additional Guidelines and Limitations

Context Mode Guidelines

Supported in single and multiple context mode.

Firewall Mode Guidelines

Supported in routed and transparent firewall mode.

IPv6 Guidelines

Supports IPv6.

Additional Guidelines and Limitations

The following guidelines and limitations apply to Webtype access lists:

• There are two types of webtype ACLs; URL based ACLs and TCP based ACLs. URL based ACLs are used to allow or deny URLs with the format -protocol://ip-address/path, these ACLs are for filtering based on clientless features. TCP based ACLs are used to allow or deny ip-address and port.
• Permitting one type of an ACL creates an implicit deny for the other type of ACL.
• The access-list webtype command is used to configure clientless SSL VPN filtering. The URL specified may be full or partial (no file specified), may include wildcards for the server, or may specify a port. See the “Adding Webtype Access Lists with a URL String” section for information about using wildcard characters in the URL string.
• Valid protocol identifiers are http, https, cifs, imap4, pop3, and smtp. The RL may also contain the keyword any to refer to any URL. An asterisk may be used to refer to a subcomponent of a DNS name.
• Smart tunnel and ica plug-ins are not affected by an ACL with ‘permit url any’ because they match smart-tunnel:// and ica:// types.
• ‘Permit url any' will allow all the urls that have format protocol://server-ip/path and will block traffic that does not match any of the protocol://address/path such as port-forwarding; the ASA admin should explicitly set an ACE to allow connection to the required port (port 1494 in case of citrix) so that an implicit deny does not occur.

Default Settings

Table 18-1 lists the default settings for Webtype access lists parameters.

Using Webtype Access Lists

This section includes the following topics:

• Task Flow for Configuring Webtype Access Lists
• Adding Webtype Access Lists with a URL String
• Adding Webtype Access Lists with an IP Address
• Adding Remarks to Access Lists

To add an access list to the configuration that supports filtering for clientless SSL VPN, enter the following command:

 

Command

Purpose

access-list access_list_name webtype { deny | permit } url [ url_string | any ] [ log [[ disable | default ] | level ] interval secs ][ time_range name ]]   hostname(config)# access-list acl_company webtype deny url http://*.cisco.example

Adds an access list to the configuration that supports filtering for WebVPN. The access_list_name argument specifies the name or number of an access list. The any keyword specifies all URLs. The deny keyword denies access if the conditions are matched. The interval option specifies the time interval at which to generate system log message 106100; valid values are from 1 to 600 seconds. The log [[ disable | default ] | level ] option specifies that system log message 106100 is generated for the ACE. When the log optional keyword is specified, the default level for system log message 106100 is 6 (informational). See the log command for more information. The permit keyword permits access if the conditions are matched. The time_range name option specifies a keyword for attaching the time-range option to this access list element. The url keyword specifies that a URL be used for filtering. The url_string option specifies the URL to be filtered. You can use the following wildcard characters to define more than one wildcard in the Webtype access list entry: Enter an asterisk “*” to match no characters or any number of characters. Enter a question mark “?” to match any one character exactly. Enter square brackets “[]” to create a range operator that matches any one character in a range. Note To match any http URL, you must enter http://*/* instead of the former method of entering http://*. To remove an access list, use the no form of this command with the complete syntax string as it appears in the configuration.

What to Do Next

Apply the access list to an interface. See the “Configuring Access Rules” section for more information.

Monitoring Webtype Access Lists

To monitor webtype access lists, enter the following command:

Configuration Examples for Webtype Access Lists

The following example shows how to deny access to a specific company URL:

The following example shows how to deny access to a specific file:

The following example shows how to deny HTTP access to any URL through port 8080:

The following examples show how to use wildcards in Webtype access lists.

• The following example matches URLs such as http://www.example.com/layouts/1033:

• The following example matches URLs such as http://www.example.com/ and http://www.example.net/:

• The following example matches URLs such as http://www.cisco.com and ftp://wwz.example.com:

• The following example matches URLs such as http://www.cisco.com:80 and https://www.cisco.com:81:

The range operator “[]” in the preceding example specifies that either character 0 or 1 can occur.

• The following example matches URLs such as http://www.example.com and http://www.example.net:

The range operator “[]” in the preceding example specifies that any character in the range from a to z can occur.

• The following example matches URLs such as http://www.cisco.com/anything/crazy/url/ddtscgiz:

Note To match any http URL, you must enter http://*/* instead of the former method of entering http://*.

The following example shows how to enforce a webtype access list to disable access to specific CIFS shares.

In this scenario we have a root folder named “shares” that contains two sub-folders named “Marketing_Reports” and “Sales_Reports.” We want to specifically deny access to the “shares/Marketing_Reports” folder.

However, due to the implicit “deny all,” the above access list makes all of the sub-folders inaccessible (“shares/Sales_Reports” and “shares/Marketing_Reports”), including the root folder (“shares”).

To fix the problem, add a new access list to allow access to the root folder and the remaining sub-folders:

Feature History for Webtype Access Lists

Table 18-2 lists each feature change and the platform release in which it was implemented.