Firepower - Geoblocking countries

[Humongous]

I geoblock traffic from most countries.  I have run into a few websites that my clients need access to but are located in one of the blocked countries.  Is there a way to allow these websites through AND continue to block other traffic from the country w/o having to purchase the URL Filtering license from Cisco?  Thanks in advance!

[Marvin Rhoads · Accepted solution]

If you want to take any policy action (monitor, block, allow by exception, etc.) for individual URL categories/reputations then you need the URL Filtering licensing.

(2024-09-21: edited for accuracy - hand coded individual URLs do not require the additional license.)

[Humongous]

That is what I thought - just wanted to verify - thanks!

[bstewart]

Were you trying to allow a specific URL (http://example.com/thing1.html) or just the site (example.com or 150.234.210.205)?

The latter shouldn't take a URL filtering license; the Security Intelligence whitelist/blocklist can handle that.

(I realize this was a year and a half ago...)

[Ty Rost]

This post is a bit older, but the solution is not correct. Manual URL filtering by use of URL groups and objects does not require a URL license. "Without a URL Filtering license, you can specify individual URLs or groups of URLs to allow or block. This option gives you granular, custom control over web traffic, but does not allow you to use URL category and reputation data to filter network traffic."

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/740/management-center-admin-74/system-licenses.html#reference_0FB126619D0649D79B4F666AACE82BAD

[Marvin Rhoads]

You are correct @Ty Rost - I should have added "categories".

I edited my post to reflect that correction

[Ty Rost]

Categories and reputation.