9

In an office environment, if I wanted to block youtube using a Cisco ISR router, I would set up the following with NBAR:

class-map match-all YOUTUBE
 match protocol http host "*youtube.com*"
!
policy-map DROP_YOUTUBE
 class YOUTUBE
   drop
!
interface FastEthernet0/0
 description TO INTERNET
 service-policy output DROP_YOUTUBE

This is a global configuration, but how does one tweak it so that it only applies to certain workstations (via IP or MAC addresses)?

  • 3
    Most Network Engineers are obsessed with details -- you have to be with so much time in a CLI vs GUI -- so normally your match proto statement would be *.youtube.com instead of *youtube.com* unless you intended to also block sites like "ihateyoutube.com" (not sure if that one's real). – generalnetworkerror Jun 6 '13 at 18:52
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 9:40
9

You could create a second match condition in the class-map matching all source IP networks you want to block (with an ACL). Any requests to youtube.com from a source IP not matched by this ACL will not be dropped.

9

The key is the 'match-all' or 'match-any' part of the class-map. You may configure the class-map either way.

class-map {match-any | match-all} *class-map name*

If you do a "match-all" class-map, all of the match conditions must be true in order for the traffic to match. As Jeremy mentioned, creating an ACL matching the particular users and matching that will do what you want.

ip access-list extended acl-block-users
permit ip 10.25.25.0 0.0.0.255 any
!
class-map match-all YOUTUBE
 match protocol http host "*youtube.com*"
 match access-group name acl-block-users
!
policy-map DROP_YOUTUBE
 class YOUTUBE
   drop
!
interface FastEthernet0/0
 description TO INTERNET
 service-policy output DROP_YOUTUBE
  • Good call pointing out the significance of "match-all" here. I neglected to mention that. – Jeremy Stretch Jun 6 '13 at 19:37
  • If the conditions are to match certain IPs along with ANY of multiple hosts, how would the match-all be effective here? I believe the config needs to be tweaked a bit? The case here is to block multiple websites for multiple types of people. – lamp_scaler Jun 7 '13 at 2:41
  • The match-all is a must because you want to match based on source host as well as URL. As I stated in my comment on your other post if you want to use match-all then you'll have to build a class per URL you want to block. – bigmstone Jun 7 '13 at 18:32
1

Upgrade cisco switch firmware to update the protocols for ip nbar

there is already a protocol ready specifically for YouTube.com, since it only matches http protocol not ssl, and you cant use ssl protocol for YouTube since its both being used for google.com, blocking it would block Google also

class-map match-any youtube-site
  match protocol YouTube
!
policy-map block-youtube
  class youtube-site
   drop
!
int Gig0/N
 service-policy output block-youtube
!

Take note that commands differ from device versions

  • Thanks for the edit was about to edit it myself. Additionally the device manual gives all the detailed answers for each command. – PauAI Jun 8 '18 at 4:21
-1

I don't believe you can block youtube.com with your router anymore. YouTube.com runs over HTTPS now which would disallow the router from inspecting the packets. Your best bet is to probably block the DNS requests for youtube.com so they can't reach the actual youtube servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.