topic Re: Firepower - Geoblocking countries in Network Security

Firepower - Geoblocking countries

Humongous — Mon, 30 Sep 2019 18:51:09 GMT

I geoblock traffic from most countries. I have run into a few websites that my clients need access to but are located in one of the blocked countries. Is there a way to allow these websites through AND continue to block other traffic from the country w/o having to purchase the URL Filtering license from Cisco? Thanks in advance!

Re: Firepower - Geoblocking countries

Marvin Rhoads — Sun, 22 Sep 2024 03:46:19 GMT

If you want to take any policy action (monitor, block, allow by exception, etc.) for individual URL categories/reputations then you need the URL Filtering licensing.

(2024-09-21: edited for accuracy - hand coded individual URLs do not require the additional license.)

Re: Firepower - Geoblocking countries

Humongous — Tue, 01 Oct 2019 13:33:22 GMT

That is what I thought - just wanted to verify - thanks!

Re: Firepower - Geoblocking countries

bstewart — Wed, 20 Jan 2021 20:05:25 GMT

Were you trying to allow a specific URL (http://example.com/thing1.html) or just the site (example.com or 150.234.210.205)?

The latter shouldn't take a URL filtering license; the Security Intelligence whitelist/blocklist can handle that.

(I realize this was a year and a half ago...)

Re: Firepower - Geoblocking countries

Ty Rost — Fri, 20 Sep 2024 17:16:54 GMT

This post is a bit older, but the solution is not correct. Manual URL filtering by use of URL groups and objects does not require a URL license. "Without a URL Filtering license, you can specify individual URLs or groups of URLs to allow or block. This option gives you granular, custom control over web traffic, but does not allow you to use URL category and reputation data to filter network traffic."

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/740/management-center-admin-74/system-licenses.html#reference_0FB126619D0649D79B4F666AACE82BAD

Re: Firepower - Geoblocking countries

Marvin Rhoads — Fri, 20 Sep 2024 17:19:34 GMT

You are correct @Ty Rost - I should have added "categories".

I edited my post to reflect that correction

Re: Firepower - Geoblocking countries

Ty Rost — Fri, 20 Sep 2024 18:01:20 GMT

Categories and reputation. 🙂