Cisco 5506x Firepower URL Filtering not working correctly

[ross_rulz]

Hi,

I have a Cisco 5506X ASA with firepower fully licensed. I have URL filtering category Pornography/Adult any reputation set to block. Now some porn websites get blocked but some don't. When I'm in the ASDM looking at the monitoring of live connections I see the porn website that went through and it says its un-categorized. I went to the bright cloud url reputation website and it classifies this website as Pornography/Adult.

So my question is why would the ASA be classifying this website us unknown?

Any thoughts I'd appreciate it. 

[ankojha]

Hi Ross,

Can you check under System->configuration ->cloud services (on version 5.4)

if the option "query cloud for unknown urls" is enabled or not .

if version 6.0 then go to System->Integration->Cisco CSI->

for same option.

if it is disabled then enable it and save it and check if issue occurs again.

rate if it helps.

Thanks,

Ankita

[ross_rulz]

Hi Antika

I already had this enabled but still no luck. Not sure what else it could be. Maybe time to open a TAC request. 

Thanks

[nspasov]

Have you tried to manually update/refresh the URL filtering database and see if that works?

Thank you for rating helpful posts!

[ross_rulz]

When you say manually update the database I have unticked Cisco CSI box saved then renabled. Is this the correct way to manually update the database?

Thanks

[ross_rulz]

I ended up opening a TAC request and the engineer identified it as a bug. Apparently this will be fixed in the next release of software. The TAC engineer ran a script to fix the issues in the mean time.

Here's the link for the bug:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy79984/?reffering_site=dumpcr