topic FTD does not block sites based on URL rule in Network Security

FTD does not block sites based on URL rule

apasat — Mon, 18 Sep 2023 13:25:17 GMT

Hello everyone,

I got an issue with FTD filtering based on URL rules (predefined categories).

I have some rules that blocks sites with adult content, gambling, video games and other categories:

Some of sites are blocked and I got ERR_CONNECTION_RESET, so it's working fine, but a lot of websites are still accessible, even if Connection Events says it's blocked based on ACP:

I made a rule for this website in screenshot based on it's URL, but it's still working. After this, I banned it's IP addresses, and it stopped working (rule worked fine).

Can someone explain me why FTD does not block websites, but sends logs that it's blocking?

Re: FTD does not block sites based on URL rule

balaji.bandi — Mon, 18 Sep 2023 14:49:25 GMT

If you looking to Block ( select Block) rather Block with reset

more informaion explained here block and block with reset (other options)

https://rayka-co.com/lesson/ftd-access-control-policy/

Re: FTD does not block sites based on URL rule

apasat — Tue, 19 Sep 2023 11:05:05 GMT

I've tried both ways, but the sites are still available, although in connections events I see that it have been blocked based on rule (for example Gambling)

Re: FTD does not block sites based on URL rule

Aref Alsouqi — Tue, 19 Sep 2023 11:24:41 GMT

Could it be the sites you tested were cached on the endpoint you tested from? if you try to ping one of those URL's would you get any responses?

Re: FTD does not block sites based on URL rule

apasat — Tue, 19 Sep 2023 11:39:12 GMT

I've accessed these pages from many workstations, also cleared cache. And yes, I get icmp responses, also telnet on 80/443 is ok. So, FTD does not block traffic

Re: FTD does not block sites based on URL rule

MHM Cisco World — Tue, 19 Sep 2023 12:15:33 GMT

Add dns server IP to ftd' make sure ftd can resolve the ip.

Re: FTD does not block sites based on URL rule

apasat — Tue, 19 Sep 2023 12:51:58 GMT

There's already DNS servers. The problem is that some of sites are blocked, and some are not, although in connections events I can see that FTD kind restricted access (it didn't).

Re: FTD does not block sites based on URL rule

MHM Cisco World — Tue, 19 Sep 2023 13:09:50 GMT

Some sites block some not'

Check site allow is bypass by prefilter acl or it already have conn.

If it have conn try clear conn and check again.

Re: FTD does not block sites based on URL rule

apasat — Tue, 19 Sep 2023 13:57:50 GMT

I've just accessed 1xbet.com (gambling site), it works fine, but conn events says that it's blocked (and one line that it's uncategorized and allowed).

Re: FTD does not block sites based on URL rule

obrien2010 — Wed, 20 Sep 2023 12:11:25 GMT

Dumb question.. Did you deploy?