URL Categories are empty in FMC connections events

[LuigiDiFronzo9542]

We have an FMC ver 7.2 and recently was activate the passive authentication through the ISE. This is for begin to use the url and content filtering with the users.

When we take a look at the collumn in the connection events we can see the URL information, but the URL category is empty.

We have activate the options 'Enable Automatic Updates' and ' Query Cisco Cloud for Unknown URLs' in the URL Filtering section and the licenses are applied to the FTD.

Any suggestion about why don't appear the URL Categories?

Thanks.

[Marvin Rhoads]

You can add a monitor rule at the top of your ACP and include all URL categories. That will show you the data in advance of having any rule that enforces based on categories.

[LuigiDiFronzo9542]

Thanks Marvin,

I tried to add all the URL categories but got the following message: 'The maximun numbre of URL objects that can be added is 50'.

I put 'any' in URLs but seem not work yet.

Did I miss something?

[Marvin Rhoads]

Try multiple monitor rules each with 50 URL categories. I used a later version (7.6 pre-release) so they must have fixed this bug.

[LuigiDiFronzo9542]

Thanks Marvin,

I tried adding only 2 categories and when I check the connection events, not only those two categories that I added but also the others appear. This is an interesting situation.

Another thing, when I added the monitor rule and save the change inmediatly appear the warning I put in the image.

[LuigiDiFronzo9542]

Hi,

After having placed only a couple of URL categories and performing monitoring, it is observed that the categorization of events is working normally. I still wonder how it's working.

However, I've noticed another detail, and that is that when performing a packet tracer, the Monitor rule that comes first always appears in the access list section, but it does not indicate the next rule in which it matches.

Do you have any idea how to solve this?

Thanks.

[Marvin Rhoads]

@LuigiDiFronzo9542 you should be able to use system support firewall-engine-debug to get a more complete view of which rule matches.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214577-firepower-data-path-troubleshooting-phas.html

[CiscoBrownBelt]

I noticed some traffic displays URL and category and some do not. Happen to know why?

[Marvin Rhoads]

Not all URLs are categorized. There are 10s of millions in existence with thousands more created every day.

[CiscoBrownBelt]

Yea I was thinking that, but then I see similar sites are so wasn't sure. Sometimes the URL is not even displayed either.

[MHM Cisco World]

Can I see screenshot of your url category

To know what issue exactly 

MHM