topic FireSIGHT URL Not Blocking on First View in Network Security

FireSIGHT URL Not Blocking on First View

TOM FRANCHINA — Tue, 12 Mar 2019 12:36:47 GMT

This is a new installation of an ASA5545 with FireSIght licensed for URL filtering

We wrote a rule for "block" not "block with reset" for URLs containing "Adult and Pornography" and applied it. It did work but only after the second view of the page. After the second view it did block the URL and the "Access Denied" screen was displayed.

Was this a user configuration issue or a FireSight issue???

Thanks,

Tom

Was there already an

Marvin Rhoads — Sun, 18 Jan 2015 14:31:25 GMT

Was there already an established tcp connection from the client you're testing from? If so, that would be used and not trigger the URL filter.

Test by first doing "clear conn" on the ASA and then hit the page with a fresh first view.

Hi Tom,not sure if this is

Rodrigo Belo — Tue, 31 Mar 2015 12:31:15 GMT

Hi Tom,

not sure if this is related (I'm new with FireSIGHT myself) but...

"Before you can perform user control using a group criterion, the system must detect activity from at least one user in that group. This initial connection is not handled by the access control rule it matches, but instead by the next rule it matches, or the access control policy default action."

http://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-user-guide/asa-firepower-module-user-guide-v541/AC-Rules-User.html