Custom Blocked Page URL
Requirement:

Starting from 4.1 has supported to send HTTP 200 deny information for URL denied by URL filtering. Some customer want that client who access blocked URL should be redirected to custom page/URL. This redirected function has higher priority than original HTTP 200 function. 

In 4.2 we can set redirect URL when client access URL which denied by IAP.

Numbers of custom URLs is up to 8. The format of command just like “dpi-error-page-url index http://www.google.com” and URL must be absolute URL which start with a scheme “http://” or “https://”.



Solution:

In 4.2 we can set redirect URL when client access URL which denied by IAP.

Numbers of custom URLs is up to 8. The format of command just like “dpi-error-page-url index http://www.google.com” and URL must be absolute URL which start with a scheme “http://” or “https://”.



Configuration:

Custom error page for web access denied by AppRF policies How to use "Custom Blocked Page URL"
 

WebUI configuration 

Step1: Add a Custom Blocked Page URL “https://www.sohu.com/”

IAP UI  - Security > Custom Blocked Page URL

Step2:binding the URL to a Roles “example”

IAP UI  - Security > Roles > Rule type > Blocked Page URL

 

 

Step3: Also need to configure DPI ACL deny rule
IAP UI  - Security > Roles > Rule type > Access control

 

 

CLI configuration:


9c:1c:12:c7:e5:72#configure t
9c:1c:12:c7:e5:72(config) #dpi-error-page-url 0 http://www.sohu.com 
9c:1c:12:c7:e5:72(config) #wlan access-rule example 
9c:1c:12:c7:e5:72(Access Rule "example") #dpi-error-page-url 0
9c:1c:12:c7:e5:72(Access Rule "example") #rule any any match app baidu deny
9c:1c:12:c7:e5:72(Access Rule "example") #no  rule any any match any any any permit
9c:1c:12:c7:e5:72(Access Rule "example") #rule any any match any any any permit
9c:1c:12:c7:e5:72(Access Rule "example") #end
9c:1c:12:c7:e5:72#commit apply

Show run 
wlan access-rule example
 index 3
 dpi-error-page-url 0
 rule any any match app baidu deny
 rule any any match any any any permit

 



Verification
  • Check the VC DNS IP setting via "show summary"

 

ac:a3:1e:c5:9c:80# show  dpi-error-page-urls 

Global DPI error page URLs Config
---------------------------------
ID  URL
--  ---
0   http://www.sohu.com


ac:a3:1e:c5:9c:80# show  access-rule example

Access Rules
------------
Dest IP  Dest Mask  Dest Match  Protocol (id:sport:eport)  Application  Action  Log  TOS  802.1P  Blacklist  App Throttle (Up:Down)  Mirror  DisScan  ClassifyMedia  Time Range Profile
-------  ---------  ----------  -------------------------  -----------  ------  ---  ---  ------  ---------  ----------------------  ------  -------  -------------  ------------------
any      any        match                                  app baidu    deny                                                                                         
any      any        match       any                                     permit                                                                                       
Vlan Id           :0
ACL Captive Portal:disable
ACL ECP Profile   :default
CALEA             :disable


DPI error page URL:0 http://www.sohu.com

 

  • Check redirect URL on Client browser 

If the clients access www.baidu.com, the following redirect URL “www.sohu.com” will happen on browser as below:

http://www.sohu.com/?user_ip=%3C192.168.1.105%3E&dest_ip=%3C115.239.210.27%3E&app_name=%3Cbaidu%3E&web_rep=%3Ctrustworthy-sites%3E&web_cat=%3Csearch-engines%3E

 

  • Check  redirect URL  for Packet captured on Client.

 

 

Version history
Revision #:
2 of 2
Last update:
‎11-25-2015 03:55 PM
Updated by:
 
Labels (1)
Contributors
Search Airheads
Showing results for 
Search instead for 
Did you mean: 
Is this a frequent problem?

Request an official Aruba knowledge base article to be written by our experts.