We want to implement a Cisco Firepower Thread Defense 1150 HA pair and are looking at the opions of adjusting the block page. The documenation is very thin about this topic. We now use a proxy server, that has limited adjustabilities of block pages as well. So we use an external block page instead, where we let the users open tickets directly via the block page itself. For this, we need some information like:
- Webiste visited
- Blocking reason
- Username
- Time & Date of the access
So in our block page for our barracuda web filter proxy, we just forward to the external page, giving all the important information in the URL. it looks like this:
<script type="text/javascript" language="javascript">
window.location.href = "http://proxyblock/?d=%d&l=%l&r=%r&t=%t&z=%z";
</script>
Forwarding to proxy block page...We are essentially looking for the same on the FTD. But there is no documentation on what variables are available that we can use... How have other companies solved this?
Thanks for any advice. Link to the documentation: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/http_response_pages_and_interactive_blocking.html
