topic Re: Hi Claudiu , in Network Security

Firepower SSL decryption doesnt work well

hacizeynal — Tue, 12 Mar 2019 13:16:32 GMT

Hello ,I have configured FMC 6.2 with the Sensor 5525 ,configured SSL decryption ,when I access to https site i see my local certificate in my browser also can see it on logs that it was decrypted and resigned ! I want to allow facebook application but block facebook like or chat ,is that technically possible ? I cant find any documentation for that case !I will appreciate if anybody helps !

You should be able to block

syeda3 — Fri, 03 Feb 2017 16:18:21 GMT

You should be able to block these using an Access Control Policy.

When you search for Applications as a condition, you will see the list that you need. Here is the screenshot showing the same:

[[{"attributes":{},"fields":{}}]]

(No subject)

syeda3 — Fri, 03 Feb 2017 16:31:10 GMT

[[{"attributes":{},"fields":{}}]]

It did not work for me ,I am

hacizeynal — Mon, 06 Feb 2017 09:57:34 GMT

It did not work for me ,I am still able to like posts on Facebook and etc, but In events I see that actually it is Blocked !

Could you provide with some

Claudiu Cismaru — Thu, 16 Feb 2017 21:13:53 GMT

Could you provide with some screenshots of the events from the Table view of events?

Hi Claudiu ,

hacizeynal — Fri, 17 Feb 2017 11:20:37 GMT

Hi Claudiu ,

I have still issue on it ,although it shows in events that it is blocked it doesn't work ,i think it never works on Firepower or PaloAlto ,it is only possible to do it on Checkpoint 😕 ,I am facing with another problem ,for example I have a department for Finance ,Youtube has been blocked ,one of user can access to it another one is not ? is it bug or something again ?

I am also have this issue. I

mlittleton — Fri, 07 Apr 2017 08:59:24 GMT

I am also have this issue. I have configured a SSL decryption. When I go to Facebook I can see that the decrption is working but I am still allowed to comment and like.

It looks like the micro application filtering does not work.

Could you provide with some

Claudiu Cismaru — Fri, 07 Apr 2017 09:08:01 GMT

Could you provide with some screenshots of the events from the Table view of events for the ones you consider they should have been blocked?

I have attached the following

mlittleton — Fri, 07 Apr 2017 10:03:39 GMT

I have attached the following screen shots SSL, Policy and events.

In the policy I want to block Facebook micro applications , Facebook messaging is blocked but all the rest of the application are not.

Any help will be appreciated. I am on 6.1.0.2

Re: Hi Claudiu ,

jdworak14 — Fri, 18 May 2018 15:08:51 GMT

Not sure if this is still being followed or updated, but i'm having similar frustration.
What i did notice with sites like YOUTUBE, Google Docs, Google Drive. In Firefox YOUTUBE will feed videos from a google site called 'c.docs.google.com' which is categorized as "Personal Storage". In IE it will come from a different site and categorized as "Streaming Media". if your ACL is blocking category "Personal Storage" then that is why some users may work and others not.... check the browser and compare their session with the Event logs.
When you say one user can access and another is blocked then verify the browser from both and see if Firefox/Chrome vs IE.
two cents...

Re: I have attached the following

Bogdan Nita — Fri, 18 May 2018 15:34:05 GMT

It seems that not all the facebook traffic is being decrypted and if the traffic is encrypted the firepower can't tell which microapp it is. If you specify an application that uses ssl in the decrypt policy it will never be decrypted.

Also there a couple of bugs opened for firepower recognizing facebook microapplications, for instance: CSCvh91548

HTH

Bogdan