Block website with NBAR on Cisco Router

Lessons Discussion
1

This topic is to discuss the following lesson:

https://networklessons.com/quality-of-service/block-website-with-nbar-on-cisco-router/

2

you can block http site with that, but you cannot block HTTPs sites with these

3

Hi Sameer,

I just updated the article to show you why we can’t block HTTPS with NBAR.

Rene

4

This is awesome! Thanks

5

What is the limit? I tried adding a lot of websites and it only shows me 7 of them when i do a show run.

6

Hi Sandra,

I’m not sure but there might be a limit on the number of URLs. If you have many websites to block like facebook or youtube you might want to lookup their IP address ranges and block those instead.

Rene

7

Unfortunately, can’t block https (youtube, mail.ru, etc)
Instead create access-list and deny all ip for approxx 30 addresses for youtube.
Is another way to block youtube for example?

8

Hi Vitaly,

HTTPS won’t work since NBAR can’t look into the packets. I don’t think Youtube publishes a list of all IP addresses that they use, maybe you can lookup their AS number, find the IP addresses and block those:

https://www.ultratools.com/tools/asnInfo

If you enter “Youtube” you can see that they use AS36561 and AS43515. You can lookup those IP addresses and block those.

Perhaps a better method would be to fix this using DNS. Use your DNS server so resolves youtube.com to a custom webpage and configure your firewall so users can’t use another DNS server.

Rene

9

Hi Rene,
In order for NBAR to work, it should have been enabled previously on the router, right?
Cisco1841(config)#int vlan 1 Cisco1841(config-if)#ip nbar protocol-discovery
Thank you!

10

Hello Adrian

Yes, that is correct.

I hope this has been helpful!

Laz

11

hi! i need to use the following commands to enable nbar?

match protocol ----> under #class-map
ip nbar protocol-discovery ?—> under interface?

confirm me?
thanks!

12

Hello Andrea

Yes, that is correct. The ip nbar protocol-discovery command must be implemented on the interface in question. You can find out more info about this at the following Cisco documentation:

Once that is done, the class map must be created using the protocol keyword in the match statement.

I hope this has been helpful!

Laz