Block website with NBAR on Cisco Router

When you create access-lists or QoS (Quality of Service) policies you normally use layers 1,2,3 and 4 information to match certain criteria. NBAR (Network Based Application Recognition) adds application layer intelligence to our Cisco IOS router, which means we can match and filter based on certain applications.

Let’s say you want to block a certain website like Normally you would look up the IP addresses that youtube uses and block those using an access-list or perhaps police / shape them in your QoS policies. Using NBAR we can match the website addresses instead of IP addresses. This makes life a lot easier. Let’s look at an example where we use NBAR to block a website (youtube, for example):

R1(config)#class-map match-any BLOCKED
R1(config-cmap)#match protocol http host "**"

First, I will create a class-map called “BLOCKED” and I will use match protocol to use NBAR. As you can see I match the hostname “”. The * means “any character”. Effectively this will block all sub-domains of, for example, “” will also be blocked. Now we need to create a policy-map:

R1(config)#policy-map DROP 
R1(config-pmap)#class BLOCKED

The policy-map above matches our class-map BLOCKED and when this matches the traffic will be dropped. Last but not least, we need to apply the policy-map to the interface:

R1(config)#interface fastEthernet 0/1  
R1(config-if)#service-policy output DROP

I will apply the policy-map to the interface that is connected to the Internet. Now whenever someone tries to reach, their traffic will be dropped. You can verify this on your router using the following command:

R1#show policy-map interface fastEthernet 0/1

  Service-policy output: DROP

    Class-map: BLOCKED (match-any)
      1 packets, 500 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: protocol http host "**"
        1 packets, 500 bytes
        5 minute rate 0 bps

    Class-map: class-default (match-any)
      6101 packets, 340841 bytes
      5 minute offered rate 10000 bps, drop rate 0 bps
      Match: any 

Above, you see that we have a match for our class-map BLOCKED. Apparently, someone tried to reach The class-map class-default matches all other traffic, and it is permitted.

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You’ve Ever Spent on Your Cisco Career!
  • Full Access to our 791 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

1643 Sign Ups in the last 30 days

100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!


Forum Replies

  1. you can block http site with that, but you cannot block HTTPs sites with these

  2. Hi Sameer,

    I just updated the article to show you why we can’t block HTTPS with NBAR.


  3. This is awesome! Thanks

  4. What is the limit? I tried adding a lot of websites and it only shows me 7 of them when i do a show run.

  5. Hi Sandra,

    I’m not sure but there might be a limit on the number of URLs. If you have many websites to block like facebook or youtube you might want to lookup their IP address ranges and block those instead.


6 more replies! Ask a question or join the discussion by visiting our Community Forum