2

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet Filtering with Static Database). Is this even possible through the ASA? I know there is a similar option with the Access Control Policies in the FirePOWER sensor but this ASA does not have a FirePOWER module.

It does have an old IPS module though.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 18:18
1

I looked up the ASA documentation, and you are right. Only FirePower allows configuration of HTTP blocked page responses. But I want to suggest an old school method for doing this.

I believe you know the destination IPs that need to be blocked, since you are already filtering the traffic. So you could use static routes for these destinations and point them to a server in your LAN, that could act as a proxy. The "blocked" page response could be served from that location.

  • That sounds interesting. Do you happen to know what type of server would serve good for this purpose? – Eduardo Barreto Rosales Jan 16 '18 at 14:51
  • The answer really depends on your traffic patterns. For low to medium usage, a virtualised Linux proxy should suffice. – surya Jan 17 '18 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.