Blocking Internet to AD Group

[Richard.Moore]

I have a Cisco ASA with Firepower. We are looking to lock down some machines by blocking the internet to them. Problem is they need internet access for our antivirus setup. I want to create a rule/policy to block internet to specific machines defined by AD Group except for websites needed for antivirus. We already have the AD group define, lets call it NoInternet, and our firepower module is setup to sync with AD. I also have the URLs we need allowed for Antivirus. 

Is it best to just add a policy to 1. allow NoInternet devices to defined Antivirus websites then. 2. block NoInternet from all other URLs. 
Sounds simple in my mind but im not 100% firepower is the best way to do it. We could statically IP the machines and just blocked them on the ASA ACLs from anything other than antivirus, but the possibility of someone changing IP settings over time is pretty high. Also, we are using ASDM to manage Firepower

[Marvin Rhoads]

The policy you suggested would be the recommended way to go.

Having your user identities and AD groups updated dynamically and the ability to use them in your policies is one of the adavantages of having AD integrated with Firepower.

[Spooster IT Services · Accepted solution]

Hi Richard,

You can use allow or deny access to internet on the basis of AD groups but Firepower binds the IP with user initially the user authenticates.If the user changed his/her machines IP after authetication or changed the network (lets say from wired to wireless) without reauthetication then Firepower will not able to identify the user. Instead you can use whitelist the Antivirus URL and blacklist the all others.

[Richard.Moore]

After reviewing in more detail. I do finch this to be correct and a possible risk. (device changing IPs and firepower not updated in timely fashion). We are considering and may choose a different, more static approach as we have had problems with the User Agent staying up and active.

Thank you for the input!