Applies To:Show Versions
- 13.1.3, 13.1.1, 13.1.0
How can I control traffic to URL categories?
A custom URL category enables you to group URLs to distinguish different types of web traffic and allow you to control it. Having custom URL categories available enables you to look up the category on a per-request basis. You can configure the per-request policy to specify whether anyone can access a URL category and when.
Example policy: User-defined category-specific access control
In this per-request policy example, only recruiters are allowed to access URLs in the user-defined category Employment. The policy also restricts access to entertaining videos during business hours.
Category-specific access restrictions (using user-defined categories)
How can I block access to URLs?
If you have custom URL categories configured, you can also configure URL filters. A URL filter specifies an action (block, allow, or confirm) to take for each custom URL category. Having URL categories and filters available enables you to look up and filter URLs on a per-request basis.
Example policy: URL filter per user group
Each URL Filter Assign item in this per-request policy example should specify a filter that is applicable to the user group.
URL filter based on group membership
Overview: Configuring user-defined URL categories and filters
On a BIG-IP® system without a URL database, if you want to control traffic based on the type of URL being requested, and you have many URLs to consider, you should configure user-defined URL categories and user-defined URL filters. This approach provides good performance, ease-of-use, and the ability to use the URL Category and the URL Filter Assign agents in a per-request policy.
If you have only a few URLs that you want to treat differently, you can probably skip creating user-defined URL categories and filters and use a simple URL Branching agent in a per-request policy. In this case, you specify the URLs that you want to match directly in the URL Branching agent.
To configure user-defined URL categories and URL filters, complete these tasks.
Configuring user-defined URL categories
On the Main tab, click
.The URL Categories table displays. If you have not created any URL categories, the table is empty.
The Category Properties screen displays.
- In the Name field, type a unique name for the URL category.
From the Default Action list, retain the default value
Block; or, select Allow.
Note: A Confirm Box action in a per-request policy subroutine serves the purpose of enabling appropriate choices in a forward proxy (outbound) configuration. Currently, Access Policy Manager® does not support a similar action for reverse proxy.
- Add, edit, or delete the URLs that are associated with the category by updating the Associated URLs list.
To add URLs to the Associated URLs list:
These are well-formed URLs:
In the URL field, type a URL.
You can type a well-formed URL that the system must match exactly or type a URL that includes globbing patterns (wildcards) for the system to match URLs.
- If you typed globbing patterns in the URL field, select the Glob Pattern Match check box .
The URL displays in the Associated URLs list.
This URL *siterequest.[!comru] includes globbing patterns that match any URL that includes siterequest, except for siterequest.com or siterequest.ru.This URL *://siterequest.com/education/* includes globbing patterns that match any HTTP URL that includes siterequest.com/education, but that do not match any HTTPS URLs if Category Lookup specifies that the input is SNI or CN.Subject.Important: For SNI or CN.Subject input, Category Lookup uses scheme:://host for matching, instead of matching the whole URL.
- In the URL field, type a URL.
The URL Categories screen displays.
To view the newly created URL category, expand Custom
The custom URL category displays in the Sub-Category column.
Configuring URL filters
On the Main tab, click
.You can click the name of any filter to view its settings.Note: On a BIG-IP® system with an SWG subscription, default URL filters, such as block-all and basic-security, are available. You cannot delete default URL filters.The URL Filters screen displays.
To configure a new URL filter, click one of these options.
- Create button: Click to start with a URL filter that allows all categories.
- Copy link: Click for an existing URL filter in the table to start with its settings.
- In the Name field, type a unique name for the URL filter.
The screen redisplays. An Associated Categories table displays. It includes each URL category and the filtering action that is currently assigned to it. The table includes a Sub-Category column. Any URL categories that were added by administrators are subcategories within Custom Categories
Select the actions to take:
The confirm action is not fully supported in a reverse proxy configuration.Note: A Confirm Box action in a per-request policy subroutine serves the purpose of enabling appropriate choices in a forward proxy (outbound) configuration. Currently, Access Policy Manager® does not support a similar action for reverse proxy.
To block access to particular categories or subcategories, select them
and click Block.
Important: When you select a category, you also select the related subcategories. You can expand the category and clear any subcategory selections.
- To allow access to particular categories or subcategories, select them and click Allow.
- To block access to particular categories or subcategories, select them and click Block.