FTD Rule Logic for URL Filtering

cmlozano8 — Fri, 21 Feb 2020 16:33:42 GMT

Hi All,

I have been running into an issue with setting up rules in FTD specifically involving URL Filtering. If I create a rule set like below:

1 any any any any any Gambling,etc Block

2 out inside any x.x.x.x 443 any Allow

3 inside outside any any any any Allow

Default Action - Block

It appears Rule 1 for URL creates a permit ip any any and sends traffic to the snort engine for URL filtering, if it is not a blocked category or url , the traffic is passed without farther inspection. Basically what I am seeing is everything is wide open inbound and the only rule to increment hit counter is rule # 1. I have run into this issue twice on two different FTDs. I am confused on why this is or if I am just not understanding something. Anyone have a set up like this?

I am checking which rule is being hit via packet trace when ssh'd into the FTD.

Chris

Re: FTD Rule Logic for URL Filtering

Abheesh Kumar — Tue, 11 Dec 2018 18:18:50 GMT

Hi,
For URL filtering create a rule like specifying the zones INSIDE to OUTSIDE and specify the URL category to BLOCK.

HTH
Abheesh

Re: FTD Rule Logic for URL Filtering

cmlozano8 — Thu, 03 Jan 2019 20:27:50 GMT

Thanks Abheesh, I think we had a misconception of how FTD rules work.

Re: FTD Rule Logic for URL Filtering

Abheesh Kumar — Thu, 03 Jan 2019 21:33:34 GMT

Hi,
Could you brief your issue you are facing...?

topic Re: FTD Rule Logic for URL Filtering in Network Security

FTD Rule Logic for URL Filtering

Re: FTD Rule Logic for URL Filtering

Re: FTD Rule Logic for URL Filtering

Re: FTD Rule Logic for URL Filtering