Manual Chapter :
Using Custom URL
Categories and Filters
Applies To:
Show VersionsBIG-IP APM
- 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0
Using Custom URL
Categories and Filters
How can I control traffic to URL
categories?
A custom URL category enables you to group URLs to distinguish different types of web traffic
and allow you to control it. Having custom URL categories available enables you to look up the
category on a per-request basis. You can configure the per-request policy to specify whether
anyone can access a URL category and when.
Example policy: User-defined
category-specific access control
In this example per-request policy, only recruiters can access URLs in the
user-defined category Employment. The policy also restricts access to entertaining videos
during business hours.
How can I block access to URLs?
If you have custom URL categories configured, you can also configure URL filters. A URL filter
specifies an action (block, allow, or confirm) to take for each custom URL category. Having
URL categories and filters available enables you to look up and filter URLs on a per-request
basis.
Example policy: URL filter per user
group
Each URL Filter Assign item in this per-request policy example needs to
specify a filter that applies to the user group.
Overview: Configuring user-defined URL categories and filters
On a BIG-IP system without a URL database, if you want to control traffic
based on the type of URL being requested, and you have many URLs to consider, you should
configure user-defined URL categories and user-defined URL filters. This approach provides good
performance, ease-of-use, and the ability to use the
URL Category
and the
URL Filter Assign
agents in a per-request policy. If you have only a few URLs that you want to treat differently, you can probably skip creating
user-defined URL categories and filters and use a simple
URL Branching
agent in a per-request policy. In this case, you specify the URLs that you want to match directly
in the URL Branching
agent. To configure user-defined
URL categories and URL filters, complete these
tasks.
Task summary
Configuring user-defined URL
categories
Configure a user-defined URL
category to specify a group of URLs over which you want to control access.
- On the Main tab, click.The URL Categories table displays. If you have not created any URL categories, the table is empty.
- ClickCreate.The Category Properties screen displays.
- In theNamefield, type a unique name for the URL category.
- From theDefault Actionlist, retain the default valueBlock; or, selectAllow.A Confirm Box action in a per-request policy subroutine serves the purpose of enabling appropriate choices in a forward proxy (outbound) configuration. Currently, Access Policy Manager does not support a similar action for reverse proxy.
- Add, edit, or delete the URLs that are associated with the category by updating theAssociated URLslist.
- To add URLs to theAssociated URLslist:
- In theURLfield, type a URL.You can type a well-formed URL that the system must match exactly or type a URL that includes globbing patterns (wildcards) for the system to match URLs.
- If you typed globbing patterns in theURLfield, select theGlob Pattern Matchcheck box .
- ClickAdd.The URL displays in theAssociated URLslist.
These are well-formed URLs:- https://www.siterequest.com/
- http://www.siterequest.com:8080/
- http://www.sitequest.com/docs/siterequest.pdf/
- http://www.sitequest.com/products/application-guides/
This URL*siterequest.[!comru]includes globbing patterns that match any URL that includessiterequest, except forsiterequest.comorsiterequest.ru.This URL*://siterequest.com/education/*includes globbing patterns that match any HTTP URL that includessiterequest.com/education, but that do not match any HTTPS URLs if Category Lookup specifies that the input is SNI or CN.Subject.For SNI or CN.Subject input, Category Lookup usesscheme:://hostfor matching, instead of matching the whole URL. - ClickFinished.The URL Categories screen displays.
- To view the newly created URL category, expandCustom Categories.The custom URL category displays in the Sub-Category column.
Add or edit a URL filter to specify
an action (allow, block, or confirm) for the custom category.
Configuring URL filters
You configure a URL filter to specify whether to allow or block requests for URLs
in URL categories. You can configure multiple URL filters.
- On the Main tab, click.You can click the name of any filter to view its settings.On a BIG-IP system with an SWG subscription, default URL filters, such asblock-allandbasic-security, are available. You cannot delete default URL filters.The URL Filters screen displays.
- To configure a new URL filter, click one of these options.
- Createbutton: Click to start with a URL filter that allows all categories.
- Copylink: Click for an existing URL filter in the table to start with its settings.
- In theNamefield, type a unique name for the URL filter.
- ClickFinished.The screen redisplays. An Associated Categories table displays. It includes each URL category and the filtering action that is currently assigned to it. The table includes a Sub-Category column. Any URL categories that were added by administrators are subcategories withinCustom Categories
- Select the actions to take:
- To block access to particular categories or subcategories, select them and clickBlock.When you select a category, you also select the related subcategories. You can expand the category and clear any subcategory selections.
- To allow access to particular categories or subcategories, select them and clickAllow.
The confirm action is not fully supported in a reverse proxy configuration.A Confirm Box action in a per-request policy subroutine serves the purpose of enabling appropriate choices in a forward proxy (outbound) configuration. Currently, Access Policy Manager does not support a similar action for reverse proxy.
To put a URL filter into effect, you must assign it in a per-request policy. A
per-request policy runs each time a URL request is made.