topic I'm using Cisco Firepower 6.2 in Network Security

URL on Cisco FirePower

KEOPUTMANO — Tue, 12 Mar 2019 09:35:17 GMT

I just built Cisco ASA with FirePower as Internet Gateway with full features. I would like to filter some URLs like Porn, Social Media, Streaming Media... However it's not working as expected. There are some issue like:

- I configured URL filter with category 'Adult and Pornography'. Then I tried to open some porn website such as https://xnxx.com and it was working. I monitored with Event Connection it allowed because this URL didn't in 'Adult and Pornography', it's unknown Category. I thought the issue related to the URL filtering DB. However CSI is up to date.

- I'm not sure why Youtube still working properly. I thought it may need some technique to filter.

That's odd. Cisco's FirePOWER

Marvin Rhoads — Wed, 14 Jun 2017 14:52:26 GMT

That's odd. Cisco's FirePOWER products use Brightcloud's category and reputation service and that site definitely shows up as adult and pornography:

http://www.brightcloud.com/tools/url-ip-lookup.php

Can you share a screenshot of your relevant Access Control Policy rule and confirm that it has been successfully deployed?

I will screenshot and let you

KEOPUTMANO — Wed, 14 Jun 2017 15:28:39 GMT

I will screenshot and let you see the Rule Configuration and Connect Event which URL traffic proceed.

What ASA model are you using?

Oliver Kaiser — Thu, 15 Jun 2017 08:47:51 GMT

What ASA model are you using?

What version of FMC & Firepower module are you using?

I'm using Cisco Firepower 6.2

KEOPUTMANO — Thu, 15 Jun 2017 16:12:06 GMT

I'm using Cisco Firepower 6.2.0 on Cisco ASA and I manage it by ASDM. Do you have any experiences to block Youtube? I have tried to block by category "Streaming Media" but it wasn't success.

Thanks,

Mano

Re: URL on Cisco FirePower

subbu1987 — Sun, 06 Jan 2019 17:02:27 GMT

It looks no body have an answer to weird behaviour of FP(FMC 6.2.2) .We are struggling since one month and even cisco TAC doesn't have answer yet

Re: URL on Cisco FirePower

Sheraz.Salim — Sun, 06 Jan 2019 17:32:58 GMT

I had a same issue after spending countless hours i find the issue. I am using 5506-x with URL,MAL,IPS lic on FMC.

whent you define a rule in ACP make sure you leave any your security zone and any interface i have attach the photo. once done then tetst it will work. i am uisng 6.2. and its blocking the adult and dirty websites.

Re: I'm using Cisco Firepower 6.2

Sheraz.Salim — Sun, 06 Jan 2019 17:47:38 GMT

if you need to block youtube then you need SSL encap/decap. because if a client type https://youtube.com than FP can not block this connection unless you have a SSL decap on box.