netdestination "GoogleAndroid"
description GoogleAndroid
no invert
name android.clients.google.com position 1
name google-analytics.com position 2
name ajax.googleapis.com position 3
!
ip access-list session "GoogleAndroid"
alias "user" alias "GoogleAndroid" any permit position 1 queue low
!
Then add to your role before deny.
user-role "ROLE"
access-list session "GoogleAndroid" position 1
!