1

How can i block youtube on a cisco router? I have already used class map as seen below

class-map match-any url-block-class
 match protocol http host "*youtube*"
!
policy-map block-class
policy-map url-block-policy
 class url-block-class

Kindly someone assist

  • 2
    I think you should probably use NBAR for something like that. – Ron Maupin Mar 14 at 13:34
  • policy-map block-class doesn't seem to do anything in the context you show us. You may want to remove it from the question, or show more details about it. – Marc 'netztier' Luethi Mar 15 at 12:19
3

This is probably much less about routing than about content filtering.

Theres multiple levels where one can try to block certain content:

  • At the routing layer: Your filtering device needs to know which IP addresses are being used by Youtube, and use a (probably dynamically updated) list of IP addresses or ranges to be blacklisted. The filtering device may be able to have an "access list" which has an FQDN object as destination address instead of an IP address (or range thereof).

  • At the DNS layer: The filtering device may snoop on DNS queries for "*.youtube.com" (and youtu.be and all of its variants) and block the query from going out, or it may fake-response an answer. This doesn't have to be a router, a tuned local DNS server can do this, too. For an example, see https://pi-hole.net

  • At the upper layer protocol (HTTP): The filtering device needs to see the HTTP GET or the HOST header request as sent by the client, and can filter based on the FQDN found in there. That's probably what your NBAR configuration snippet tries to do, but very probably won't have any effect because: see below.

  • At the upper layer protocol (HTTPS/TLS): Youtube is all HTTPS these days. To block it at the application layer, you need an inspection mechanism that can snoop into the SSL/TLS negotiation, and extract the SNI (Server Name Indication) from the client's SSL request and/or the server certificate's CN (CommonName) from the server's SSL response, and recognize "youtube" based on the information found in there. Unless most recent TLS is being used, these fields are sent in cleartext before encryption is established, and are accessible to the filtering device.

On IOS-XE, probably on other IOSs too, you can try to use an SSL Custom Application (For some examples, see https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/qos-nbar-xe-3s-book/nbar-ssl-custom-appl-xe.html#GUID-31C35EC0-26B2-44F1-A348-75C18011BB7A)

ip nbar custom name ssl unique-name  www.example.com id  11

You can also use NBAR to look at DNS:

ip nbar custom cust1 dns dns-name *example.com id 1

Also see https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/15-mt/qos-nbar-15-mt-book/nbar-custapp-dns.html and https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/15-mt/qos-nbar-15-mt-book/nbar-cust-protcl.html

... and then you would use that custom application in your class-map, much like you already did.

1

You can use NBAR on your Cisco router. See Cisco documents, such as QoS: NBAR Configuration Guide , for more information.

To match browsing on YouTube, you can create a class:

class-map match-all YouTube
 match protocol http hostname *youtube.com

To match YouTube videos, you would have a different class:

class-map match-all youtube
 match protocol youtube

You could also create a class for either (notice we use match-any rather than match-all to get a match for either one):

class-map match-any YouTube
 match protocol http hostname *youtube.com
 match protocol youtube

You could then have a policy to drop anything in the YouTube class

policy-map No_YouTube
 class YouTube
  drop
!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.