topic Re: Cisco firewall not allowing ngrok.com in Network Security

Cisco firewall not allowing ngrok.com

muqtaderrazvi — Fri, 21 Feb 2020 16:52:00 GMT

when I am visiting ngrok.com I am getting the error "Access to this destination is not allowed due to a possible malware threat"

what could be the issue?

ASA is blocking ngrok software too within the network.

Re: Cisco firewall not allowing ngrok.com

Abheesh Kumar — Tue, 26 Feb 2019 10:09:42 GMT

Hi,
Are you using Cisco WSA, Its not blocked by ASA may be your proxy is denying this traffic.

HTH
Abheesh

Re: Cisco firewall not allowing ngrok.com

balaji.bandi — Tue, 26 Feb 2019 13:29:40 GMT

as per the Talos site looks neutral, is the ASA with Firepower ?

https://www.talosintelligence.com/

Re: Cisco firewall not allowing ngrok.com

muqtaderrazvi — Wed, 27 Feb 2019 07:38:21 GMT

no we are not using any proxy and wsa

Re: Cisco firewall not allowing ngrok.com

muqtaderrazvi — Wed, 27 Feb 2019 07:40:14 GMT

no we are not using firepower.

this is why I am confused why ASA is blocking, moreover talcos is showing the website as neutral

Re: Cisco firewall not allowing ngrok.com

balaji.bandi — Wed, 27 Feb 2019 08:37:15 GMT

we need more inforamtion about your setup, this error produce internally ? if so how is your traffic flow going outside, in the path from user pc to internet, there is some kind proxy or thread analysis running to get this.

Re: Cisco firewall not allowing ngrok.com

muqtaderrazvi — Wed, 27 Feb 2019 10:28:35 GMT

User PC----->Access Switch (2960)----->Core Switch (3850)----->ASA

There is no proxy and tread analysis

Re: Cisco firewall not allowing ngrok.com

balaji.bandi — Wed, 27 Feb 2019 11:35:38 GMT

After ASA internet ?

is the error you see on browser ?

can you give us full screenshot, what IP address this sending this warning.

Re: Cisco firewall not allowing ngrok.com

muqtaderrazvi — Wed, 27 Feb 2019 13:31:47 GMT

yes, internet is after asa.

we are seeing this error on browser. Attachment contains the screenshot of the browser.

Re: Cisco firewall not allowing ngrok.com

balaji.bandi — Wed, 27 Feb 2019 15:02:16 GMT

Does your PC have Any Connect Client ?

Re: Cisco firewall not allowing ngrok.com

muqtaderrazvi — Thu, 28 Feb 2019 05:29:43 GMT

No we don't have any connect. It is not just the one PC that is facing this problem, all PC in network is having same problem.

Re: Cisco firewall not allowing ngrok.com

Abheesh Kumar — Thu, 28 Feb 2019 06:16:41 GMT

Ngrok site uses SSL and if you open the page with http it will be redirected to https. In your case some thing in between is blocking the page itself. Are you using Cisco umbrella..? Can you check nslookup from your PC whether it is resolving properly...?

Re: Cisco firewall not allowing ngrok.com

muqtaderrazvi — Thu, 28 Feb 2019 07:05:17 GMT

Not using cisco umbrella

Nslookup is fine giving same ip. check attachment

Re: Cisco firewall not allowing ngrok.com

balaji.bandi — Thu, 28 Feb 2019 08:51:36 GMT

I think for now we are only guessing how your network, based on that we are suggesting. either you have some filters which is part of the network. Since we do not able to reproduce the isse you were mentioned.

who is your service ISP provider ?

Re: Cisco firewall not allowing ngrok.com

muqtaderrazvi — Sun, 03 Mar 2019 05:38:30 GMT

my ISP is beam (from India)

Re: Cisco firewall not allowing ngrok.com

Abheesh Kumar — Sun, 03 Mar 2019 07:23:44 GMT

If you are sure there is nothing blocking from your network then, Plz check with your ISP they may be blocked this.

HTH
Abheesh

Re: Cisco firewall not allowing ngrok.com

balaji.bandi — Sun, 03 Mar 2019 08:28:38 GMT

i am sure BEAM using some content Proxy, may be as per the TRAI Policies. please check with BEAM customer care.(ACT now i guess).