Firepower ACL rule with AD account is NOT working...

[eeebbunee]

Dear Experts,

For some reason, Rules in ACL doesn't work especially rules with AD account. (Users)

For example, 

We have allow rule for indeed.com and lilnkedin.com for specific users, and last rule covers block those websites.

However, linkedin.com is works for some users following the rule (up here), on the contrary indeed blocks everyone.

Can anyone suggest solution for me?

Thank you very much.

[Francesco Molino]

Hi

Can you share the log showing indeed is being blocked please with the info you see on the column url?

[eeebbunee]

Hello Francesco!

please see my rules:

Block Log is following:

Allow rule is placed to Rule#46 and detail URLs are below:

The reason why I put the https://indeed.com and Indeed.com seperately is that none of forms of URL doesn't work.

(http://www.indeed.com, https://indeed.com, indeed.com. those are all the same results.)

and my Block rule is placed to 52, which is last match.

[Francesco Molino]

Can you change your object to have the value indeed.com only because you're going to https://www.indeed.com and you configured https://indeed.com

[eeebbunee]

I have changed URL only go for indeed.com but still no luck... I don't get it why I can reach to Linkedin but Indeed with a same rule?

Do you think our firepower has an issue?

[Francesco Molino]

Can you share an output of your connection events please?

Also, could you do system support trace on clish and share the output?

[SinghRaminder]

can you provide us the output of:

Packet-tracer input inside tcp user <YOUR USER iN QUESTION> 12345 fqdn indeed.com 443

[eeebbunee]

Hello,

When I typed cli, it gives me an error :

Is this command line related to firepower os version?

our current version is 6.2.3, and we will upgrade on this weekend.

Thank you!

[SinghRaminder]

Try this please

Packet-tracer input inside tcp user <YOUR DOMAIN\sweeney.kim> 12345 fqdn indeed.com 443