topic Re: URL Filtering not working on ASA Firepower 5506-X in Network Security

URL Filtering not working on ASA Firepower 5506-X

JimGyt — Fri, 21 Feb 2020 16:55:22 GMT

Hi everyone, first of all i'm very new at cisco firewall so i may have made big mistakes in my configuration. I'm trying to configure a Firepower ASA 5506-X to use the URL Filtering for blocking access to some websites.

Everything goes well, i followed the explanation on Cisco Website:

- I updated my ASA and ASDM

- I created a service policy rules (match any) to redirect the traffic to the Firepower

- I created a new rule

- Saved everything and Deploy

But nothing happens. I can still access to everything i tried to block. I also notice in ASA Firepower Reporting that nothing move like i didn't redirect the traffic. A little help will be appreciate, thanks.

Re: URL Filtering not working on ASA Firepower 5506-X

Marvin Rhoads — Sun, 10 Mar 2019 05:17:13 GMT

In your Rules.JPG attachment it shows the box for "Enable ASA Firepower for this traffic flow" as unchecked. It needs to be checked.

Re: URL Filtering not working on ASA Firepower 5506-X

johnlloyd_13 — Sun, 10 Mar 2019 14:29:58 GMT

hi, marvin is correct. you'll need to redirect traffic to the FP module for inspection. see helpful link:

http://wannabecybersecurity.blogspot.com/2019/01/cisco-asa-firepower-traffic-redirection.html

i would also suggest adding a top most rule (rule #1) to allow DNS. see helpful link:

http://wannabecybersecurity.blogspot.com/2019/02/configuring-cisco-firepower-access.html

Re: URL Filtering not working on ASA Firepower 5506-X

JimGyt — Mon, 11 Mar 2019 08:03:21 GMT

Hi, thank you for answer. I have tried and still no luck. I took the screenshot while i was creating the rule, and i did it too quickly. I will try yours suggestions right now. Thanks

Re: URL Filtering not working on ASA Firepower 5506-X

JimGyt — Mon, 11 Mar 2019 10:34:38 GMT

Hi again, i discover an odd thing. In the monitoring of the ASAFirepower, it shows the connection at Youtube.com as blocked as i wanted but in fact i can still navigate. After some testing i noticed that i seems to work on Edge but not in Chrome.

EDIT: The problem is solved. Just wanted to share it in case somebody need it. The configuration was fine but i was only testing with Chrome and Youtube as URL. There is a known issue i found in Cisco Bug Search Tool and there is a workaround for Chrome and Youtube by disabling QUIC.

Thanks everybody.