One way to do this. You need to create a black list of domains.

Note: URL Filtering on the ASA is not very good. It may cause legitimate sites to be blocked that shouldn't. Also this way of blocking only drops the connection. No warning page or error will appear on the users screen. A much better way to block websites is by using OpenDNS, Squid, or other proxy or filtering service.

Here is the Configlet for this how-to:

regex domainlist1 ".facebook.com" regex domainlist2 ".myspace.com" regex domainlist3 ".youtube.com" ! access-list URLfilter extended permit tcp any any eq www ! class-map type regex match-any DomainBlockList match regex domainlist1 match regex domainlist2 match regex domainlist3 ! class-map type inspect http match-all BlockDomainsClass match request header host regex class DomainBlockList ! class-map type regex match-any URLBlockList ! class-map type inspect http match-all BlockURLsClass match request uri regex class URLBlockList ! class-map httptraffic match access-list URLfilter class-map type inspect http match-all BlockURLsClass match request uri regex class URLBlockList !  policy-map type inspect http http_inspection_policy parameters protocol-violation action drop-connection match request method connect drop-connection log class BlockDomainsClass reset log ! policy-map inside-policy class httptraffic inspect http http_inspection_policy ! service-policy inside-policy interface inside

Steps (4 total)

1

Add the domains you want to block.

These are added by using Regex expressions, here are three example domains:

regex domainlist1 ".facebook.com"  regex domainlist2 ".myspace.com"  regex domainlist3 ".youtube.com"

You can add up to 100 expressions.

Then tie these expressions together:

class-map type regex match-any DomainBlockList  match regex domainlist1  match regex domainlist2  match regex domainlist3

2

Create an Access List for what IPs this list should apply to

In our example, we are applying this to all internal IPs:  access-list URLfilter extended permit tcp any any eq www

If you have any IP's you do NOT want effected by this policy simply add a deny access list to the URLfilter list with the IP's or object group you want it to apply to.

3

Create your policy that enforces your list and ties your ACL to it

class-map type inspect http match-all BlockDomainsClass  match request header host regex class DomainBlockList  !  class-map type regex match-any URLBlockList  !  class-map type inspect http match-all BlockURLsClass  match request uri regex class URLBlockList  !  class-map httptraffic  match access-list URLfilter  class-map type inspect http match-all BlockURLsClass  match request uri regex class URLBlockList  !  policy-map type inspect http http_inspection_policy  parameters  protocol-violation action drop-connection  match request method connect  drop-connection log  class BlockDomainsClass  reset log  !  policy-map inside-policy  class httptraffic  inspect http http_inspection_policy

4

Activate your policy

service-policy inside-policy interface inside

NOTE: Every time you add or remove a regex expression you will need to remove this line then re-add it in order for the changes to go into effect.