ASA MPF http filtering : regex class vs http class match-any

Hi,

requirement is to BLOCK access to sites facebook.com and yahoo.com

regex facebook "facebook\.com"
regex yahoo "yahoo\.com"

there are 2 ways 2 do this, are these identical and work?

class-map type regex REGEX
match regex yahoo
match regex facebook

class-map type inspect http HTTP
match request header host regex class REGEX

OR
class-map type inspect http match-any HTTP
match request header host regex yahoo
match request header host regex facebook

Then under policy map I have option of reset or drop-connection which one
consider as BLOCK access ?

reset: drop connection ans send RST to sender
drop-connection: drop without notification

Blogs and organic groups at http://www.ccie.net
Received on Sun Sep 08 2013 - 17:20:54 ART