deny internet access on our domain controller

[VOLUS]

i have installed firepower on my ASA 5516 as SFR module, 

i am using ASDM to manage rules ,

any idea how to block internet access on my domain controller, and please note that this domain controller is the DNS server. 

I tried deny any any on DCs IP addresses than I allowed port 53 and didn't work .

[balaji.bandi]

Is this FW also facing Internet and you do NAT ?

on your DC DNS Server, what DNS server external configured ?

so your rule should allow

Source : your local DNS

Destination : 8.8.8.8 4.4.4.4

service 53 allow.

example :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/firewall/asa-914-firewall-config/access-umbrella.html

[VOLUS]

hello, 

can you please share the config from firepower and not ASA as i redirected all traffic to firepower 

[Kasun Bandara · Accepted solution]

Check below guide of configuration.

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/getting_started_with_access_control_policies.html

make sure you are sending all traffic via FP module using ASA service policy