9

In an office environment, if I wanted to block youtube using a Cisco ISR router, I would set up the following with NBAR:

class-map match-all YOUTUBE
 match protocol http host "*youtube.com*"
!
policy-map DROP_YOUTUBE
 class YOUTUBE
   drop
!
interface FastEthernet0/0
 description TO INTERNET
 service-policy output DROP_YOUTUBE

This is a global configuration, but how does one tweak it so that it only applies to certain workstations (via IP or MAC addresses)?

Improve this question
2
  • 3
    Most Network Engineers are obsessed with details -- you have to be with so much time in a CLI vs GUI -- so normally your match proto statement would be *.youtube.com instead of *youtube.com* unless you intended to also block sites like "ihateyoutube.com" (not sure if that one's real).
    – generalnetworkerror
    Commented Jun 6, 2013 at 18:52
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 20, 2020 at 18:27

4 Answers 4

Reset to default
9

You could create a second match condition in the class-map matching all source IP networks you want to block (with an ACL). Any requests to youtube.com from a source IP not matched by this ACL will not be dropped.

Improve this answer
9

The key is the 'match-all' or 'match-any' part of the class-map. You may configure the class-map either way.

class-map {match-any | match-all} *class-map name*

If you do a "match-all" class-map, all of the match conditions must be true in order for the traffic to match. As Jeremy mentioned, creating an ACL matching the particular users and matching that will do what you want.

ip access-list extended acl-block-users
permit ip 10.25.25.0 0.0.0.255 any
!
class-map match-all YOUTUBE
 match protocol http host "*youtube.com*"
 match access-group name acl-block-users
!
policy-map DROP_YOUTUBE
 class YOUTUBE
   drop
!
interface FastEthernet0/0
 description TO INTERNET
 service-policy output DROP_YOUTUBE
Improve this answer
3
  • Good call pointing out the significance of "match-all" here. I neglected to mention that.
    – Jeremy Stretch
    Commented Jun 6, 2013 at 19:37
  • If the conditions are to match certain IPs along with ANY of multiple hosts, how would the match-all be effective here? I believe the config needs to be tweaked a bit? The case here is to block multiple websites for multiple types of people.
    – lamp_scaler
    Commented Jun 7, 2013 at 2:41
  • The match-all is a must because you want to match based on source host as well as URL. As I stated in my comment on your other post if you want to use match-all then you'll have to build a class per URL you want to block.
    – bigmstone
    Commented Jun 7, 2013 at 18:32
1

Upgrade cisco switch firmware to update the protocols for ip nbar

there is already a protocol ready specifically for YouTube.com, since it only matches http protocol not ssl, and you cant use ssl protocol for YouTube since its both being used for google.com, blocking it would block Google also 

class-map match-any youtube-site
  match protocol YouTube
!
policy-map block-youtube
  class youtube-site
   drop
!
int Gig0/N
 service-policy output block-youtube
!

Take note that commands differ from device versions

Improve this answer
1
  • Thanks for the edit was about to edit it myself. Additionally the device manual gives all the detailed answers for each command.
    – PauAI
    Commented Jun 8, 2018 at 4:21
-1

I don't believe you can block youtube.com with your router anymore. YouTube.com runs over HTTPS now which would disallow the router from inspecting the packets. Your best bet is to probably block the DNS requests for youtube.com so they can't reach the actual youtube servers.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.