cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
513
Views
0
Helpful
4
Replies
Highlighted
Beginner

URL Filtering on SSL-RAVPN User FDM 6.2.3

I already done the SSL VPN Remote Access setup, and user already can connect to inside network and access the internet following the company network (I dont use split tunnel for that connectivity). 

 

i enable the NAT Exempt and inside interface all inside zone interface.

 

I already set up the access control, to block some website, here my access control configuration

source :

- zone = outside

- address = object network user vpn (50.x/24) 

- port = ANY

destination : 

- zone = ANY

- address = ANY

- port = ANY

application : 

- youtube

url filtering : 

- object url : https://youtube.com, https://twitter.com

action : block

 

But user vpn still can access twitter and youtube.

is there any solution for this case?

 

thanks

Everyone's tags (4)
4 REPLIES 4
VIP Advisor

Re: URL Filtering on SSL-RAVPN User FDM 6.2.3

Make sure the VPN IP address have access rules

 

here is the example video how you can block the URLS

 

https://www.youtube.com/watch?v=VA2S5h3zeVc

 

BB
*** Rate All Helpful Responses ***
Cisco NGFW Access-Policy - Configure a access policy to block Adult Categories. Note: this example is an interactive block.
Hall of Fame Guru

Re: URL Filtering on SSL-RAVPN User FDM 6.2.3

@balaji.bandi I believe both youtube.com and twitter.com use both HTTP Strict Transport Security (HSTS) and Public Key Pinning (PKP). We can confirm this in Chrome via the query box at chrome://net-internals/#hsts

This creates a problem for a middleware box like Firepower since it cannot reliably intercept the traffic. For example, certificate SNI inspection doesn't work since yourtube.com uses *.google.com as its certificate.

The best and much more reliable way to block these clients is to use Cisco Umbrella which works by preventing the sites' DNS resolution and instead redirecting the client to a block page.

VIP Advisor

Re: URL Filtering on SSL-RAVPN User FDM 6.2.3

@Marvin Rhoads i can understand what you saying, but if the VPN Terminate in to FTD, (if the user do no have umbrella or other DNS Sec solution) - can we achieve this using ACL filtering with FQDN ( as per my understand FTD support this feature)

 

I do agree the video is bit away from this issue, The video just given example to understand how one can filter.

 

what would be the soluition or best approach, happy to hear / listen and understand what iam missing here ?

 

 

 

 

BB
*** Rate All Helpful Responses ***
Hall of Fame Guru

Re: URL Filtering on SSL-RAVPN User FDM 6.2.3

Sorry for the delay - I had on my list to test this. I just checked it in my lab and found that www.twitter.com and www.youtube.com were blocked just fine with a URL filtering ACP rule.

I noticed the original post had "youtube" application in the policy. When my client was blocked it was categorized as simply "https" application and "ssl client".

Here're the working policy and results for me:

ACP Rule blocking URLs.PNGBlock results.PNG