topic FMC with restricted Internet Connection: Need URLs!! in Network Security

FMC with restricted Internet Connection: Need URLs!!

Soporteco — Fri, 21 Feb 2020 16:01:15 GMT

Hi. I haven't been able to find the information.

We're deploying a new virtual FMC that is going to manage 2 FTD devices (2100). This customer doesn't want to give full Internet access to this machine, they say they want to restrict to certains ports and public IP Addresses.

How can I find which URLs/Public IP Address we need to consider? I need connection to Smart Licensing, since we will be using Smart Licenses for FTD, and I know FMC also needs to consult to the cloud for AMP analysis, VDB- Snort updates, Security Intelligence, etc.

I appreciate if someone can help us to find out which URLs we need to permit, or how can we approach this!

Re: FMC with restricted Internet Connection: Need URLs!!

Rahul Govindan — Wed, 25 Jul 2018 21:11:53 GMT

Required ports and access for the Firepower is documented here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/security__internet_access__and_communication_ports.html

From an allowed URL perspective, I know of a few that the Firepower uses (at least previously):

support.sourcefire.com

software.cisco.com

intelligence.sourcefire.com

database.brightcloud.com

service.brightcloud.com

My recommendation is to remove the FMC from any access restriction rules. I have had trouble with FMC downloading URL Databases when I put it through existing content filters/proxies etc.

Re: FMC with restricted Internet Connection: Need URLs!!

Soporteco — Wed, 25 Jul 2018 23:43:36 GMT

thanks a lot Rahul

I had already seen that document, where they explain the reason for Internet access (by feature), but URL's are not included. Unfortunately this customer insists on filtering by domains or Public IP Addresses, but I'm seeing it quite difficult.

Re: FMC with restricted Internet Connection: Need URLs!!

Rahul Govindan — Thu, 26 Jul 2018 00:19:50 GMT

I agree with you, but the only ones I have are the ones below:

support.sourcefire.com

software.cisco.com

intelligence.sourcefire.com

database.brightcloud.com

service.brightcloud.com

If you can use wildcard's, then try allowing .cisco, .sourcefire and .brightcloud to the allow list. The problem with static ip addresses is that the content is mostly stored on AWS or on CDN's, which almost always changes.

Re: FMC with restricted Internet Connection: Need URLs!!

Raghunath Kulkarni — Thu, 26 Jul 2018 03:12:50 GMT

Hi,

Though not consolidated, but all the URL's can be determined in the below 3 documents:

https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118852-technote-firesight-00.html

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118791-technote-firesight-00.html

Re: FMC with restricted Internet Connection: Need URLs!!

Soporteco — Thu, 26 Jul 2018 17:29:41 GMT

Thanks a lot, that's very useful.

However, I'm still worried about the connection to Smart Licensing Portal. FTD devices use Smart Licensing, and FMC will need a connection to the cloud. I've read so many documents about Smart Licensing but none of them give me information about IP addreses or URLs.

Re: FMC with restricted Internet Connection: Need URLs!!

Raghunath Kulkarni — Fri, 27 Jul 2018 01:25:13 GMT

As far as smart licensing is concerned, we need to make sure that the URL:
https://smart-satellite.cisco.com:443 to be resolved by the FMC at any given point in time.

Re: FMC with restricted Internet Connection: Need URLs!!

Soporteco — Fri, 27 Jul 2018 16:58:35 GMT

Hi Raghunat, but that URL is not resolvable, are you sure we need that one?

Re: FMC with restricted Internet Connection: Need URLs!!

Tiago Andrade de Paula — Wed, 17 Apr 2019 14:02:42 GMT

Hi Raghunath.
Good solution to resolve the internet restrictions in FMC server and use smartlicense. But this no resolve the fact that we need to have the FMC witch internet connection to have a database updated, receive feeds right?

Re: FMC with restricted Internet Connection: Need URLs!!

lingesha.ts — Thu, 25 Jul 2019 07:22:39 GMT

The URL https://smart-satellite.cisco.com:443 is not accessible.

Is this URL is mandatory or Is there any other URL instead of this ?

Re: FMC with restricted Internet Connection: Need URLs!!

isaac_ferreira — Wed, 19 Feb 2020 02:40:47 GMT

You can check the link :

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/security__internet_access__and_communication_ports.html