Restricted access not working from fmc and ftd firewall

[ShareefKooliyodan0444]

Dears, 

I  have issue with rules ,

i created 2 rules from fmc ,Rule1 deny all internet access for specific network or vlan for example server vlan 172 Network 192.168.172.0 and 172 192.168.173.0 . 

and rule2 allow access network or vlan for example server vlan 172 Network 192.168.172.0 and 172 192.168.173.0 only for falcon.crowdstrike.com  and windowsupdates.com . 

I created rules like above ,rule1 deny is working blocking internet access for all servers but rule2 not working servers cant able to access falcon.crowdstrike.com  and windowsupdates.com. 

Could you Guyz please help me resolve the above issues. 

Thank you 

[Marius Gunnerud]

I had a little trouble following what your issue is.  To my understanding it is the following:

• Rule 1 deny rule works.
• Rule 2 access from VLAN 172 to crowdstrike and windowsupdate does not work.

Do you have NAT configured for the traffic? Run a packet-tracer to see if traffic is actually allowed through the firewall, if it is not this should give you a reason for the drop.

[ShareefKooliyodan0444]

Yes, nat policy is there, also has internet access for rest of VLan.  i need to configure restricted access for above networks. 

[Marius Gunnerud]

How have you confiugred the access rules then?  using FQDN object or URL filtering?  If using FQDN is the FTD able to resolve the URLS?

[ShareefKooliyodan0444]

Please check attached , allowed from access policy as you said, but still not work . 

[Marius Gunnerud]

So you are using both Network object and URL.  As long as there are no redirections happening do other URLs, I would suggest removing the URL configuration and just use the Network object.

[ShareefKooliyodan0444]

I removed URL , but the same cant access  sites . if unblock from block rule it is working but  getting full internet access 

[Marius Gunnerud]

Could you post the block rule configuration please

[ShareefKooliyodan0444]

Okay , please check attached ,its block rule.