Cisco firewall not allowing ngrok.com

[muqtaderrazvi]

when I am visiting ngrok.com I am getting the error "Access to this destination is not allowed due to a possible malware threat"

what could be the issue?

ASA is blocking ngrok software too within the network.

[Abheesh Kumar]

Hi,
Are you using Cisco WSA, Its not blocked by ASA may be your proxy is denying this traffic.

HTH
Abheesh

[muqtaderrazvi]

no we are not using any proxy and wsa

[balaji.bandi]

as per the Talos site looks neutral, is the ASA with Firepower ?

https://www.talosintelligence.com/

[muqtaderrazvi]

no we are not using firepower.

this is why I am confused why ASA is blocking, moreover talcos is showing the website as neutral

[balaji.bandi]

we need more inforamtion about your setup, this error produce internally ? if so how is your traffic flow going outside, in the path from user pc to internet, there is some kind proxy or thread analysis running to get this.

[muqtaderrazvi]

User PC----->Access Switch (2960)----->Core Switch (3850)----->ASA

There is no proxy and tread analysis

[balaji.bandi]

After ASA internet ?

is the error you see on browser ?

can you give us full screenshot, what IP address this sending this warning.

[muqtaderrazvi]

yes, internet is after asa. 

we are seeing this error on browser. Attachment contains the screenshot of the browser.

[balaji.bandi]

Does your PC have Any Connect Client ?

[muqtaderrazvi]

No we don't have any connect. It is not just the one PC that is facing this problem, all PC in network is having same problem.

[Abheesh Kumar]

Ngrok site uses SSL and if you open the page with http it will be redirected to https. In your case some thing in between is blocking the page itself. Are you using Cisco umbrella..? Can you check nslookup from your PC whether it is resolving properly...?

[muqtaderrazvi]

Not using cisco umbrella 

Nslookup is fine giving same ip. check attachment

[balaji.bandi]

I think for now we are only guessing how your network, based on that we are suggesting. either you have some filters which is part of the network. Since we do not able to reproduce the isse you were mentioned.

who is your service ISP provider ? 

[muqtaderrazvi]

my ISP is beam (from India)