FireSIGHT URL Not Blocking on First View

[TOM FRANCHINA]

This is a new installation of an ASA5545 with FireSIght licensed for URL filtering

We wrote a rule for "block" not "block with reset" for URLs containing "Adult and Pornography" and applied it. It did work but only after the second view of the page. After the second view it did block the URL and the "Access Denied" screen was displayed.  

Was this a user configuration issue or a FireSight issue???

Thanks,

Tom

[Marvin Rhoads]

Was there already an established tcp connection from the client you're testing from? If so, that would be used and not trigger the URL filter.

Test by first doing "clear conn" on the ASA and then hit the page with a fresh first view.

[Rodrigo Belo]

Hi Tom,

not sure if this is related (I'm new with FireSIGHT myself) but...

"Before you can perform user control using a group criterion, the system must detect activity from at least one user in that group. This initial connection is not handled by the access control rule it matches, but instead by the next rule it matches, or the access control policy default action."

http://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-user-guide/asa-firepower-module-user-guide-v541/AC-Rules-User.html