topic Re: Firepower Rule limit to adding URL in Network Security

Firepower Rule limit to adding URL

Muhammad Amin Zia — Fri, 21 Feb 2020 15:57:33 GMT

Hello experts Once again I am here to discuss my issue with you guys. In my firesight whenever I add any rule for blocking URL's that rule has limit to add only 50 URL's in one rule. I need to know how to increase this limit because i don't want to add rule again and again when its 50 limit threshold has reached. Is there any possible solution?

Re: Firepower Rule limit to adding URL

Marvin Rhoads — Mon, 09 Jul 2018 15:36:28 GMT

Have you considered using a DNS list in Security Intelligence section as opposed to an URL filtering policy?

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/reusable_objects.html#ID-2243-00000135

https://packetu.com/2016/07/03/understanding-firepower-dns-policies/

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Wed, 11 Jul 2018 04:49:10 GMT

Thank you for your reply but I have checked the option it has ip blocking option but cannot block URL. I need to increase the URL counting more then 50 in rule set.

Re: Firepower Rule limit to adding URL

Marvin Rhoads — Wed, 11 Jul 2018 06:44:00 GMT

I don't know where you see the limitation on blocking URLs.

URLs are included in the custom feed options and they are quite scalable. As noted in the configuration guide:

"The number of entries you can include is limited by the maximum size of the file. For example, a URL list with no comments and an average URL length of 100 characters (including Punycode or percent Unicode representations and newlines) can contain more than 5.24 million entries."

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Wed, 11 Jul 2018 12:03:06 GMT

thats great Marvin further can you share me the gui steps or any link for configure to block URLs

Re: Firepower Rule limit to adding URL

Rahul Govindan — Wed, 11 Jul 2018 12:49:10 GMT

The 50 limit rule is when you add url's directly into the rule. This limitation is present for applications as well. In addition to what @Marvin Rhoads mentioned, you can create a url object group and add more than 50 url's to that. You can then call the url object group into the rule.

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Thu, 12 Jul 2018 05:51:52 GMT

Great can you tell me how many URL's can be added in one URL object group?

Re: Firepower Rule limit to adding URL

Rahul Govindan — Thu, 12 Jul 2018 19:43:35 GMT

I don't recall a limit on this. I have added 150+ URL's using API's to a single object.

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Fri, 13 Jul 2018 03:02:41 GMT

Ok and brother when i start adding url there are only 2 options for URL one is individual object and other is object group and each individual object can add only 1 URL on this way if i have to add 150 URL i have to create individual 150 objects and then those object will be called in a single object group and single object group will be called in a rule. I wonder is there any limit for adding individual objects??? Also is their any way to add multiple url directly in object group ??? Instead of individual objects. Your help will be highly appreciated

Re: Firepower Rule limit to adding URL

Rahul Govindan — Fri, 13 Jul 2018 15:44:55 GMT

Yes you can. You can manually add URL's like I have attached below:

You can also use API's under the FMC API explorer to add multiple URL's is one go. A sample of what I used is here:

{
"name": "Test_URL_Object",
"literals": [
  {
      "url": "cisco.com",
      "type": "Url"
    },
  {
      "url": "apple.com",
      "type": "Url"
    }
],
"type": "UrlGroup"
}

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Sat, 14 Jul 2018 06:19:36 GMT

look in the attached screenshot I am not getting option to add URL individually. I only have an option to add URL into individual object group then into URL group please suggest.

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Mon, 16 Jul 2018 13:35:44 GMT

is there any solution brother?

Re: Firepower Rule limit to adding URL

Marvin Rhoads — Mon, 16 Jul 2018 14:19:44 GMT

As Rahul noted, the GUI is one URL at a time.

If you want to do a bulk add then you would need to use the API and build a script to load them in all at once.

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Tue, 17 Jul 2018 11:00:15 GMT

Thank you Marvin. Can you help me to open API explorer at firepower. I am new at it. I have tried several links on google for this but no luck can you explain this in detail?

Re: Firepower Rule limit to adding URL

Rahul Govindan — Tue, 17 Jul 2018 11:52:57 GMT

https://blogs.cisco.com/security/how-to-get-started-on-programming-firepower-using-fmc-apis

API explorer URL:

https://<fmc_url>/api/api-explorer/

Re: Firepower Rule limit to adding URL

Muhammad Amin Zia — Tue, 24 Jul 2018 05:56:52 GMT

Dear Rahul,

I have tried the above statement in URL but it gives the attached forbidden error. please suggest.

Re: Firepower Rule limit to adding URL

Marvin Rhoads — Tue, 24 Jul 2018 14:05:13 GMT

I suspect you haven't enabled the REST API. Please check as shown inthe configuration guide here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/api/REST/Firepower_Management_Center_REST_API_Quick_Start_Guide_620/About_the_Firepower_REST_API.html