topic Re: URL Whiltelisting on ASA without FirePOWER license in Network Security

URL Whiltelisting on ASA without FirePOWER license

PETER NEGUS — Fri, 21 Feb 2020 16:16:29 GMT

We want to deny all outbound web access except to a group of about 10 whitelist URL domains on an ASA 5525-X with FirePOWER services. Is it possible to do this on the ASA without an add-on FirePower license? Will this have a significant performance impact?

Re: URL Whiltelisting on ASA without FirePOWER license

Joel — Mon, 24 Sep 2018 14:47:55 GMT

It is possible to create an object within the ASA using a FQDN. To do this the ASA has to be able to resolve names.

dns domain-lookup inside
dns server-group DefaultDNS
name-server x.x.x.x
domain-name company.com

Example of a FQDN object

object network site.example.com
fqdn site.example.com

You then put this into an ACL. i.e. access-list inside-in extended permit tcp object inside-networks object site.example.com eq www

Note issues will occur if a site utilises global load balancers, where your inside clients resolve site.example.com as xyz but the ASA gets the IP zyx. Also, you can't do wildcards i.e. *.microsoft.com

Ultimately, if it's really basic you can do it. Otherwise you need something designed for a web gateway.

Joel

Re: URL Whiltelisting on ASA without FirePOWER license

PETER NEGUS — Mon, 24 Sep 2018 14:56:34 GMT

Thank you very much for your suggestion. Unfortunately it doesn't work in our case because we have multiple target hosts within a domain, which need to be expressed as a wildcard - for example *.anynet.network.com . As the FQDN is based on a DNS lookup, wildcards don't work.

Sorry for not making my initial query clearer

Peter

Re: URL Whiltelisting on ASA without FirePOWER license

balaji.bandi — Mon, 24 Sep 2018 20:40:20 GMT

You can build one as example shown below document.

https://community.cisco.com/t5/security-documents/asa-url-filtering-without-a-websense-or-n2h2-smartfilter-server/ta-p/3116352

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/115998-asa-http-product-configuration-example-00.html

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100535-asa-8x-regex-config.html

Re: URL Whiltelisting on ASA without FirePOWER license

PETER NEGUS — Tue, 25 Sep 2018 11:44:41 GMT

Hi Balaji

Thank you very much for your suggestions. Do you know if this will require a FirePOWER license, and if so, which one?

Re: URL Whiltelisting on ASA without FirePOWER license

Marvin Rhoads — Tue, 25 Sep 2018 13:33:24 GMT

The MPF/regex-based approach doesn't require the Firepower service module at all. No special ASA license is required - just the base software.

I almost never see it in use in live networks though as it never caught on since it's so burdensome to configure.

A much more sustainable solution is to use Firepower with URL Filtering or, better yet, Cisco Umbrella.