topic Re: How to block url for HTTPS traffic without SSL decpryptions on FTD 6.2.3? in Network Security

How to block url for HTTPS traffic without SSL decpryptions on FTD 6.2.3?

slv_slv — Mon, 05 Apr 2021 13:05:29 GMT

Hi All

I'm using FTD on ASA 5506x v6.2.3.16-59 (managed by Firepower Device Management) with latest updates.

I have rule with app filter HTTPS and url category which should be blocked Dating (just for testing)

as you can expect this rule is not working correclty - thats why I'm asking you for help here 😉

Traffic hit correct sec rule, so app detection is working fine, also url categoryzation seems to be fine.

Why this traffic is allowed? Whats wrong here ?

I wouldn't do a SSL decrypt becase my device is too small, but based on SSL cert SNI block urls.

Regards

Slawek

balaji.bandi — Mon, 05 Apr 2021 13:11:21 GMT

you need to bring up the rule above the 2nd rule, as per the screenshot, your 2nd rule has any any HTTPS allowed.

here is a guide :

Karsten Iwen — Mon, 05 Apr 2021 13:37:35 GMT

For me, it looks like it worked as expected and the session was blocked.

slv_slv — Mon, 05 Apr 2021 14:00:18 GMT

Where do you see action block on provided screenshots? This webpage is fully loaded on my laptop.

Marvin Rhoads — Mon, 05 Apr 2021 14:06:45 GMT

The top of your screenshot says "Connection Event ---- Block".

Did you clear your browser cache or try opening the site in a private/incognito browser session?