topic Re: URL Categories are empty in FMC connections events in Network Security

URL Categories are empty in FMC connections events

LuigiDiFronzo9542 — Thu, 05 Sep 2024 15:01:08 GMT

We have an FMC ver 7.2 and recently was activate the passive authentication through the ISE. This is for begin to use the url and content filtering with the users.

When we take a look at the collumn in the connection events we can see the URL information, but the URL category is empty.

We have activate the options 'Enable Automatic Updates' and ' Query Cisco Cloud for Unknown URLs' in the URL Filtering section and the licenses are applied to the FTD.

Any suggestion about why don't appear the URL Categories?

Thanks.

Re: URL Categories are empty in FMC connections events

Marvin Rhoads — Thu, 05 Sep 2024 16:40:44 GMT

You can add a monitor rule at the top of your ACP and include all URL categories. That will show you the data in advance of having any rule that enforces based on categories.

Re: URL Categories are empty in FMC connections events

LuigiDiFronzo9542 — Thu, 05 Sep 2024 17:20:18 GMT

Thanks Marvin,

I tried to add all the URL categories but got the following message: 'The maximun numbre of URL objects that can be added is 50'.

I put 'any' in URLs but seem not work yet.

Did I miss something?

Re: URL Categories are empty in FMC connections events

Marvin Rhoads — Fri, 06 Sep 2024 08:44:18 GMT

Try multiple monitor rules each with 50 URL categories. I used a later version (7.6 pre-release) so they must have fixed this bug.

Re: URL Categories are empty in FMC connections events

MHM Cisco World — Fri, 06 Sep 2024 12:19:01 GMT

Can I see screenshot of your url category

To know what issue exactly

MHM

Re: URL Categories are empty in FMC connections events

LuigiDiFronzo9542 — Fri, 06 Sep 2024 20:05:41 GMT

Thanks Marvin,

I tried adding only 2 categories and when I check the connection events, not only those two categories that I added but also the others appear. This is an interesting situation.

Another thing, when I added the monitor rule and save the change inmediatly appear the warning I put in the image.

Re: URL Categories are empty in FMC connections events

LuigiDiFronzo9542 — Wed, 18 Sep 2024 21:11:57 GMT

Hi,

After having placed only a couple of URL categories and performing monitoring, it is observed that the categorization of events is working normally. I still wonder how it's working.

However, I've noticed another detail, and that is that when performing a packet tracer, the Monitor rule that comes first always appears in the access list section, but it does not indicate the next rule in which it matches.

Do you have any idea how to solve this?

Thanks.

Re: URL Categories are empty in FMC connections events

CiscoBrownBelt — Tue, 25 Feb 2025 14:43:52 GMT

I noticed some traffic displays URL and category and some do not. Happen to know why?

Re: URL Categories are empty in FMC connections events

Marvin Rhoads — Wed, 26 Feb 2025 17:15:19 GMT

Not all URLs are categorized. There are 10s of millions in existence with thousands more created every day.

Re: URL Categories are empty in FMC connections events

Marvin Rhoads — Wed, 26 Feb 2025 17:17:05 GMT

@LuigiDiFronzo9542 you should be able to use system support firewall-engine-debug to get a more complete view of which rule matches.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214577-firepower-data-path-troubleshooting-phas.html

Re: URL Categories are empty in FMC connections events

CiscoBrownBelt — Wed, 26 Feb 2025 17:27:07 GMT

Yea I was thinking that, but then I see similar sites are so wasn't sure. Sometimes the URL is not even displayed either.