topic When it is working the show in Network Security

firepower url filtering not working as expexcted

Philippos Ioannou — Tue, 12 Mar 2019 12:38:51 GMT

Have asa5512x with firepower and 5.4 installed on device and defence centre is also 5.4

everything was working ok up until 2 days ago were the url filtering will stop blocking bad sites. in the connection event logs it does not show anymore

the url category or reputation on the specific website, it is blank. at the access control rule it show default action. it is as if the access control policy is not working at all. have seen previous question about how this was fixed in 5.4 but here we have it again. has any one managed to fix this

we had the same issue and got

bernhard.hoerl — Tue, 12 May 2015 17:01:12 GMT

we had the same issue and got the url filter to work properly with a workaround from tac

by adding a monitor rule with the same categories we tried to block above the block urls rule the filter seems to work as it should. by adding this the website is first categorized and then the blocking rule matches

i hope this was helpful!

Try to upgraded to 5.4.1.1

alberx — Fri, 22 May 2015 14:11:21 GMT

Try to upgraded to 5.4.1.1 Sourcefire and 5.4.0.2 for the sensors released past thursday 21/05.

I did it yesterday and it resolved some of my problems of non blocking sites or nos showing http response page.

In the end of the last year i

Carlos Alberto de Barros — Fri, 08 Apr 2016 19:24:12 GMT

In the end of the last year i had this same problem in a customer... but after update to version 5.4.0-4 the URL filtering works fine.

Today i got the same problem again, but now i update to version 5.4.0-5 and after to 5.4.0-7, and still does not work.

Hi Bernhard!

Akzhol Konurbaev — Tue, 07 Jun 2016 05:48:07 GMT

Hi Bernhard!

What do you mean?

is that right ?

Hello Akzhol!

bernhard.hoerl — Tue, 07 Jun 2016 06:02:28 GMT

Hello Akzhol!

Yes, looks good.

But if you are using one of the latest Firepower versions this should not be a problem anymore. Currently I'm using version 6.0.1 and I'm very happy with it.

My Firepower version 6.0.1.

Akzhol Konurbaev — Tue, 07 Jun 2016 06:37:00 GMT

My Firepower version 6.0.1.
But it still doens't work.
URL Blocks works only 10-15 min but then allow pass traffic

We have version 6.0.1 with

saleff — Tue, 07 Jun 2016 14:36:58 GMT

We have version 6.0.1 with the exact same problem.

Hello Team,

Jetsy Mathew — Wed, 08 Jun 2016 05:35:20 GMT

Hello Team,

There are several bugs reported in version 5.4 and 5.4.x reported with the url filtering . Thus it would be really recommended to upgrade the version to 6.0 or highest since the url filtering is stable in this versions.Based on the error what you told, it looks like hitting a bug.

Regards

Jetsy

We have version 6.0.1 and it

saleff — Wed, 08 Jun 2016 12:23:54 GMT

We have version 6.0.1 and it still has the same problem. It stop filtering at random for about ten minutes and then it works again.

Hello Team,

Jetsy Mathew — Thu, 09 Jun 2016 05:17:58 GMT

Hello Team,

I have faced a similar issue where the URL filtering rule never works properly in version 6 .Sometimes it follows the AC policy rule and block it or allow it accordingly sometimes its not. Have you added any security zone to the interface options in the Device management. We have a known bug reported while using asa sfr with url filtering contains the security zone. We have hotfix available for this issue and issue can be resolved . To confirm it , you have to open a Cisco TAC request so that the engineer can work on it to verify and provide you the hotfix that is available. The issue is there in 6.0.0 as well as 6.0.0.1. Thus you need to install the hotfix based on the version that you have.

Rate if this answer helps you.

Regards

Jetsy

Thanks Jesty for the reply. I

saleff — Thu, 09 Jun 2016 13:10:30 GMT

Thanks Jesty for the reply. I will forward this info to the TAC Engineer that is working on this case.

Hi,

ankojha — Thu, 09 Jun 2016 14:03:04 GMT

Hi,

In the connection events. is it showing url category or showing as uncategorized ?

Thanks,

Ankita

When it is working the show

saleff — Thu, 09 Jun 2016 14:49:28 GMT

When it is working the show up as category and when it is not blocking what it should it shows up as uncategorized.

Thanks

Hello Saleff,

Jetsy Mathew — Fri, 10 Jun 2016 05:21:29 GMT

Hello Saleff,

Please open a new TAC service request with Cisco TAC so that they can verify and provide you the hotfix if the issue is confirmed.

Rate if this answer helps you.

Regards

Jetsy