Firepower URL access rule question

[SIMMN]

Hi,

Within FMC, if you setup a access control rule, you define the action to be allowed or deny etc. Then define the matching criteria, like network and/or services. But one question regarding the URL portion: if the action set to Allow for the rule, then what categories of URL to be selected, the permitted categories OR blocked ones?

Say, I want to allow LAN end-user web traffic outbound, but I want to block access to URL categories: Porn and Illegible... So can I do this in one rule OR I have to do two rules: one just to block those URL categories and second rule to allow web traffic?

[Marvin Rhoads · Accepted solution]

Make a rule with action "block" and the URL categories you wish to block. Follow it with an allow for other traffic. Just like in an ASA, the rules are evaluated from the top down and first match ends the ACP (Access Control Policy) rule processing.

[SIMMN]

Thanks, Thats what I thought...

Comparing to other vendors, like PAN and Fortinet, their setup is using security profile (such web filter profile) to control the content blocking even the access control which has the profile associated is set to allow.

The ASA/SFR way is not much more labor effort but just different I guess...