topic Sergio, in Network Security

Sourcefire URL Filtering

shubhamkulkarni39 — Tue, 12 Mar 2019 12:43:37 GMT

Hi all,

I have one question about Sourcefire URL Filtering,

As I know Sourcefire does not support SSL Encryption/decryption,

My Question is How does it blocks HTTPS Websites ? , eg: https://facebook.com.

Hi shubhamkulkarni39We have

Sergio Garrido — Wed, 29 Jul 2015 21:23:27 GMT

Hi shubhamkulkarni39

We have the same question a year ago.

We block HTTPS website using the follow trick:

Step 1:

Go to Object Management -> URL -> Individual Objects -> Add URL

Set name to the URL object, and type the url, for example, to block

Facebook, type "facebook.com" unquoted.

Step 2:

Go to the rule in Access control policy and associate this object to the rule.

Step 3:

Apply all changes, wait a litle time until the control policy status go from

"Appying to device" to "Policy Up-to-date on device"

Step 4:

Try your config.

I hope help you

With the 5.4.x version of

rcmcdermott11 — Fri, 14 Aug 2015 17:51:05 GMT

With the 5.4.x version of code you can perform SSL encryption/decryption and apply policy.

Are you sure? I thought you

mythosmc1 — Mon, 17 Aug 2015 20:15:01 GMT

Are you sure? I thought you couldn't do SSL decryption with SourceFire and that you required separate SSL hardware

Do you have any documentation that shows its possible now?

Certain. See the traffic

rcmcdermott11 — Tue, 18 Aug 2015 16:05:31 GMT

Certain. See the traffic decryption section of the 5.4.1 user guide: http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401.html

To answer your question about

steveahughes — Thu, 20 Aug 2015 14:51:21 GMT

To answer your question about how SourceFire filters URL traffic from HTTPS sites. SourceFire uses the Certificate name and SAN names that are sent from the remote end to your PC. Although the packet is sent as DTLS, the SAN names can be read in clear text. I have ran a packet capture to test.

Thanks Steve can you send me

shubhamkulkarni39 — Fri, 21 Aug 2015 13:54:30 GMT

Thanks Steve

can you send me the packet capture, it would be useful for me to understand.

Sergio,

dips00009 — Fri, 09 Dec 2016 19:41:04 GMT

Sergio,

Are you able to redirect the user to a custom webpage if they try to visit a HTTPS site or do they just wait for a timeout message to appear?