FirePOWER not blocking TOR even with enabled security intelligence

[epaskgict]

I have Cisco ASA5525-X Threat Defense and i cannot block tor networks. I have configured Security Intelligence to black list tor-exit-node but no luck. Any suggestions?

[Marvin Rhoads]

I've done it sccessfully (and verified via testing) with clients running FMC 6.1 and later. What version are you running? Have you confirmed that your Security Intelligence feed (Objects > Security Intelligence > Network Lists and Feeds > Cisco-Intelligence-Feed) is being updated?

Can you share a screenshot of your Access Control Policy Security Intelligence settings and confirm it is deployed to the device?

Also, if you can, share a connection event showing the allowed connection to a TOR exit node.

[Robin-H]

No success with blocking users from using e.g. Onion Browser here.

• FMC 7.6.5
• Cisco-Intelligence-Feed shows last update from an hour ago

Here´s the Security Intelligence Setting. I also tried adding Tor_exit_node in the Networks section.

Event log snippet:

The destination IP is 192.42.116.86.

According to the Onion browser, this IP is the entry guard.

I probably lack some understanding on how TOR works but the list is called Tor_exit_nodes and is published by the project itself. I have the impression I can use it to block Tor users from accessing my webservers. But I want to prevent my users from accessing TOR and thus I´d need to block access to these entry points. I found some information regarding blocking access to TOR Directory Authorities but there doesn´t seem to be such list in FMC.

When I activate the obfs4 bridge in the browser, the traffic is blocked via App category. But with no bridge configuration, the FTD seems unable to identify the traffic.