Block Page - Asa Firepower

[carlos.joya]

Hi everyone,

Now i´m working with a ASA 5506X, and Sourcefire module, by now it´s working ok but i have an issue with the block page (Https response) beacuase only works with Internet Explorer and the other Browser dont, and also don´t show the http response when the page is working with securty (HTTPS).

The policies of URL Filtering are working fine, the issue is that i cannot see the block page that i have customized with browsers like Mozilla or Chrome and when the page use port 443.

Does anyone know why that happens?

Thanks for read. :)

[Aastha Bhardwaj · Accepted solution]

Hi,

For Https websites we will not receive a Block message  the reason is because https contains encrypted data and Firepower module does not have the capability to decrypt the encrypted traffic. Only Hardware Firepower appliances and now Drambuie the latest release 6.0 will have that capability to decrypt SSL traffic.

Only FirePOWER Series-3 device support SSL at this time so this is expected behavior .

Regards,

Aastha

Rate if it helps!!!

[carlos.joya]

Hi,

Thanks for your reply, now the reason is clear, Do you know if sometime cisco will release an upgrade for this issue?

Regards.

[Aastha Bhardwaj]

Hi,

The new release coming up 6.0 , that should support this.

Regards,

Aastha

Rate if that helps!!!

[Dennis Perto]

This is not supported in version 6.0. 

The manual states that:

Response pages do not appear when web traffic is blocked:

• by a Security Intelligence blacklist, and the session was originally encrypted; this includes encrypted connections blocked by the SSL inspection feature, as well as decrypted and encrypted traffic that matches a Block or Interactive Block access control rule

• as a result of a promoted access control rule, after a connection has been established and allowed to flow for a few packets so the system can inspect it for requested URLs and application details