topic Re: FMC - All URL's are Uncategorized in Network Security

FMC - All URL's are Uncategorized

scvvuuren — Fri, 23 Oct 2020 07:42:24 GMT

Good Day

I have recently setup a new FMC 6.6 with FTD environment for a customer.

Mostly all feeds seems to be working(Threat Intel/IPS/Updates) but for the life of me I cant seem to get the URL Categories in the system.

The first thing I noticed is the FMC does not use the proxy configuration to query the URL Categories, so we allowed FMC IP to query it directly and it seemed to update the feed now.

As for the policy it is essentially an any any permit for URL Category at this stage.

In the Connection Events View the application for example shows Facebook but the URL Category remains unknown.

It has to be noted that the actual connection destination is a Proxy Server that is not encrypted to the FTD can see the URL so I do not think that should be an issue.

Has anyone seen this behavior before or am I missing something on the policy side?

Re: FMC - All URL's are Uncategorized

Aref Alsouqi — Fri, 23 Oct 2020 10:44:51 GMT

Did you enable the URL filtering on FMC? the URL category and reputation data are downloaded from Cisco cloud. If you did not enable URL filtering on FMC, FMC would not be able to talk to Cisco cloud, hence, won't be able to categorize the URLs.

On FMC go to System > Integration > Cloud Services and enable automatic updates and Query Cisco Cloud for Unknown URLs.

Re: FMC - All URL's are Uncategorized

Marvin Rhoads — Fri, 23 Oct 2020 11:36:59 GMT

In addition to what @Aref Alsouqi mentioned, you didn't mention if you have the URL Filtering license and have associated with the managed device.

Re: FMC - All URL's are Uncategorized

scvvuuren — Fri, 23 Oct 2020 12:30:57 GMT

URL Filtering is enabled yes and confirmed on the GUI that it is updating, Query Cisco Cloud for Unknown URLs are disabled as the customer does not wish to submit their internal DNS entries which they deem Sensitive.

From my understanding if the Category Download Runs it should show the categories for well known sites at least?

Re: FMC - All URL's are Uncategorized

Aref Alsouqi — Fri, 23 Oct 2020 13:16:07 GMT

I think until you enable Query Cisco Cloud option, the FMC would not be able to categorize the URLs. The FMC would not be able to know the "well-known" URLs till it lookup for them, so, first time the FMC sees the URL, it would not have any clue about its reputation/category, this is why you see its reputation/category as unknown. The FMC then tries to lookup for that URL via contacting Cisco cloud, and just after that is successful, the FMC would be able to categorize it.

Re: FMC - All URL's are Uncategorized

INFOTECH.jw — Sun, 25 Oct 2020 09:43:47 GMT

Please check https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs71034

If this matches you should rename the virtual account.