cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2910
Views
0
Helpful
3
Replies

Cisco firepower blocks "VPNs" in an access policy but block Duo Mobility Software

robertmeier
Level 1
Level 1

In Firepower  I have an Access policy that blocks VPN Clients.  There are about 50 VPN clients that cisco has labeled.  Anyway  I had a user group that accesses a third-party website that uses Duo Mobility.  Cisco firepower sees this a "VPN" and blocks it.  Does anyone know how to fix this?

1 Accepted Solution

Accepted Solutions

Rahul Govindan
VIP Alumni
VIP Alumni

Unfortunately, there is no easy way to fix faulty application detection by the Firepower. I have had many instances were legitimate sites were being detected as VPN's or proxies by Firepower. So much so, that we had to remove the application category and only add individual VPN applications that did not cause a problem. 

 

I would create a temporary allow rule for source ip addresses to bypass the VPN block rule. You can add the site URL in the allow ACL conditions. Also, look for the name of the site inside the SSL certificate that it presents, sometimes the Firepower classifies the website based on that information too. 

 

You should open a TAC case and have them open a bug. The more the cases opened for this, the better chance that it gets resolved. 

View solution in original post

3 Replies 3

Rahul Govindan
VIP Alumni
VIP Alumni

Unfortunately, there is no easy way to fix faulty application detection by the Firepower. I have had many instances were legitimate sites were being detected as VPN's or proxies by Firepower. So much so, that we had to remove the application category and only add individual VPN applications that did not cause a problem. 

 

I would create a temporary allow rule for source ip addresses to bypass the VPN block rule. You can add the site URL in the allow ACL conditions. Also, look for the name of the site inside the SSL certificate that it presents, sometimes the Firepower classifies the website based on that information too. 

 

You should open a TAC case and have them open a bug. The more the cases opened for this, the better chance that it gets resolved. 

You can either bypass the inspection per Source IP or add whitelist the known ("offending" for Cisco) URLs

Rahul  thank you for your help!

Review Cisco Networking for a $25 gift card