topic Re: FirePower allow visit to specific websites in Network Security

FirePower allow visit to specific websites

Roy Lee — Mon, 03 May 2021 07:39:51 GMT

Hi All,

We setup FirePower with NAT(PAT I think) for a group of computer so that they can access internet.

However, we want to allow all computers able to visit a list of websites.

Is it possible and how?

Thanks,

Roy

Re: FirePower allow visit to specific websites

Rob Ingram — Mon, 03 May 2021 07:43:57 GMT

@Roy Lee

Are you running FTD and how are you managing it, FMC or FDM?

Or are you running ASA with Firepower services?

What licensing do you have?

You could use URL filtering if you are licensed or FQDN objects, example here.

Re: FirePower allow visit to specific websites

Roy Lee — Mon, 03 May 2021 08:38:35 GMT

@Rob Ingram

We are running FTD and managing it by FMC.

Not all our internal computers are NATed. How can they access?

Thanks,

Roy

Re: FirePower allow visit to specific websites

Rob Ingram — Mon, 03 May 2021 08:44:43 GMT

@Roy Lee

You'll at least need to PAT traffic from the internal lan, hiding traffic behind the outside interface. You don't need a static NAT per host if that is what you were implying. Restrict the outbound traffic using the options I previously metioned.

The other alternative is to use a proxy server, only this server would then need a NAT and outbound firewall rules. You can restrict outbound traffic on the proxy from the internal hosts ip address/username etc.

Re: FirePower allow visit to specific websites

Roy Lee — Mon, 03 May 2021 09:09:49 GMT

@Rob Ingram

Yup, PAT with your suggestion will work. I have to modify the existing lazy Access Policy inside any > outside any.

May I have some example for FMC for URL filtering or FQDN object?

Thanks,

Roy Lee

Re: FirePower allow visit to specific websites

Rob Ingram — Mon, 03 May 2021 09:22:18 GMT

FQDN DNS filtering

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214698-understand-fqdn-feature-on-firepower-thr.html

URL Filtering

https://www.youtube.com/watch?v=nXIBDQqekPY

https://wannabecybersecurity.blogspot.com/2019/07/configuring-cisco-fmc-url-filtering.html

Re: FirePower allow visit to specific websites

euwjrtei — Fri, 18 Mar 2022 09:13:19 GMT

In some DHCP swimming pools, you have designated a DNS server other than eight.Eight.8.Eight to get the web agency service., is that on cause ? Are these 'problem' web sites not handy from unique Vlans, or from everywhere ?