topic Re: User based URL Access in Network Security

User based URL Access

Fantas — Fri, 21 Feb 2020 17:35:45 GMT

Hi,

How we can setup rules on FMC to allow users to access social media sites like facebook.com and block access to public drives like onedrive and drop box.

Is there any way FMC allow access on user group base through Active Directory (AD). How we can setup this part of user group information gather from AD and allow access to URLs.

Re: User based URL Access

Marvin Rhoads — Thu, 17 Oct 2019 10:52:38 GMT

You can do this on FMC if you've integrated yoru AD with Realm integration and are gathering User-IP mapping with an identity source like Firepower User Agent or Cisco ISE. You would of course require a URL Filtering license.

Personally I find this easier to do (and with superior reporting and fine-grained control) using Cisco Umbrella. Of course that's a separate product with its own deployment and costs.

Re: User based URL Access

Fantas — Fri, 18 Oct 2019 06:06:13 GMT

Thanks,

why I need user agent as If I dont wana monitor user activity.

I have already download user group from AD and now I wana add url filter rule but cant see anything in available realms.

But when I check in realms its their in included but cant see it under rules for url filtering.

please confirm if i am missing any thing and why cant see realms in policy rules so that I can filter user

And Is user agent necessary for url filtering.

Re: User based URL Access

Marvin Rhoads — Fri, 18 Oct 2019 10:42:26 GMT

Simply pulling groups and user names from AD realms isn't enough. You need the username to IP address mapping. That's what an identity source like User Agent gives you. ISE and captive portal are other identity sources.

Re: User based URL Access

Fantas — Sat, 19 Oct 2019 05:47:20 GMT

Thanks,

Can we install user agent on same jump server where we access FMC or it needs to be on dedicated windows machine.

Re: User based URL Access

Marvin Rhoads — Sun, 20 Oct 2019 04:12:02 GMT

The User Agent can be on any Windows machine that has the appropriate access to the domain controller(s).

The User Agent Configuration Guide has more details here:

https://www.cisco.com/c/en/us/td/docs/security/firesight/user-agent/24/config-guide/Firepower-User-Agent-Configuration-Guide-v2-4/ConfigAgent.html#65849

Re: User based URL Access

Fantas — Tue, 22 Oct 2019 23:35:27 GMT

Thanks,

Currently I am testing url filtering with FMC Realm and can see users in my access control policy.

Re: User based URL Access

Sakun Sharma — Wed, 23 Oct 2019 04:23:05 GMT

Is there any other way for ISE to pass logs to FMC without pxGrid? Or is there way to perform authentication to AD via FMC?

Thanks

Re: User based URL Access

Marvin Rhoads — Wed, 23 Oct 2019 04:29:52 GMT

Yes you can have users and groups as elements in your ACPs with only Realm integration.

However until you have an identity source to associate them with IP addresses, the users and group elements will not have any effective use.

Re: User based URL Access

Marvin Rhoads — Wed, 23 Oct 2019 05:43:01 GMT

1. No.

2. You could use the captive portal but I've not done so.

https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/introduction_to_network_discovery_and_identity.html#concept_6C9FF477EEB643FD80818C0FAA91DAB3

Re: User based URL Access

Fantas — Wed, 23 Oct 2019 06:19:51 GMT

Hi,

You can do Active Authentication through Identity policy on FMC, I am doing passive authentication and at some stage might needs active authentication.

This Issue I have , I have did URL filtering for my inside client based on domain user name and allowed only Facebook.com in access policy but still client is able to access all other web sites including Facebook.com.

Re: User based URL Access

Marvin Rhoads — Wed, 23 Oct 2019 17:45:35 GMT

Can you share your Access Control Policy rules?

Re: User based URL Access

Fantas — Wed, 23 Oct 2019 18:29:15 GMT

Hi,

I configured active authentication on fmc after import certificate with basic http.

First time browser asks for domain username and password for http site after entering I got access but now its not asking any of the http sites and I can access all http and https sites from client , its strange.

So again I am on below issues, anyone have same issues and fixed them , please share

1 - URL Filtering are not working properly for http sites

2 - URL Filtering for https sites still need to be setup

My ACP allows only facebook.com but from client I can access all http and https sites.

In logs I can see my domain user access to all those web sites