FMC how to turn off connection events for URL added to Global-Blacklist-for-URL

[FGR]

I added a few URL's to the Global-Blacklist-for-URL in FMC.

Now I get too many connection events with reason  "URL Block" 

Is there a setting turning off this type of event?

[Marvin Rhoads · Accepted solution]

Depending on the rest of your Access Control Policy entries, you may be able to put in an initial rule that's designed just to block the traffic based on URL filtering (as opposed to picking it up on the Security Intelligence (SI) blacklist) and not enable logging for that rule.

As long as you are catching it via SI I think it's going to generate connection events. You can of course filter those events from your display; but they will still be logged.

[FGR]

I was a little afraid we had to buy an URL license when using an URL rule in an Access Control Policy. This is not the case, and this works!

[harmesh88]

So in this case we should remove URL From SI and add that URL in URLFilter right ?

[FGR]

Yes, that's what I did.

(1) Create Blocking Access Rule for URLs with event-log off (see attachment)

(2) Remove them from Objects -> Object Management -> Security Intelligence -> URL Lists and Feeds -> Global-BlackList-for-URL