URL Filtering on SSL-RAVPN User FDM 6.2.3

[Yuslivan]

I already done the SSL VPN Remote Access setup, and user already can connect to inside network and access the internet following the company network (I dont use split tunnel for that connectivity). 

i enable the NAT Exempt and inside interface all inside zone interface.

I already set up the access control, to block some website, here my access control configuration

source :

- zone = outside

- address = object network user vpn (50.x/24) 

- port = ANY

destination : 

- zone = ANY

- address = ANY

- port = ANY

application : 

- youtube

url filtering : 

- object url : https://youtube.com, https://twitter.com

action : block

But user vpn still can access twitter and youtube.

is there any solution for this case?

thanks

[balaji.bandi]

Make sure the VPN IP address have access rules

here is the example video how you can block the URLS

https://www.youtube.com/watch?v=VA2S5h3zeVc

[Marvin Rhoads]

@balaji.bandi I believe both youtube.com and twitter.com use both HTTP Strict Transport Security (HSTS) and Public Key Pinning (PKP). We can confirm this in Chrome via the query box at chrome://net-internals/#hsts

This creates a problem for a middleware box like Firepower since it cannot reliably intercept the traffic. For example, certificate SNI inspection doesn't work since yourtube.com uses *.google.com as its certificate.

The best and much more reliable way to block these clients is to use Cisco Umbrella which works by preventing the sites' DNS resolution and instead redirecting the client to a block page.

[balaji.bandi]

@Marvin Rhoads i can understand what you saying, but if the VPN Terminate in to FTD, (if the user do no have umbrella or other DNS Sec solution) - can we achieve this using ACL filtering with FQDN ( as per my understand FTD support this feature)

I do agree the video is bit away from this issue, The video just given example to understand how one can filter.

what would be the soluition or best approach, happy to hear / listen and understand what iam missing here ?

[Marvin Rhoads]

Sorry for the delay - I had on my list to test this. I just checked it in my lab and found that www.twitter.com and www.youtube.com were blocked just fine with a URL filtering ACP rule.

I noticed the original post had "youtube" application in the policy. When my client was blocked it was categorized as simply "https" application and "ssl client".

Here're the working policy and results for me: