Showing results for 
Search instead for 
Did you mean: 


URL Filtering on SSL-RAVPN User FDM 6.2.3

I already done the SSL VPN Remote Access setup, and user already can connect to inside network and access the internet following the company network (I dont use split tunnel for that connectivity). 


i enable the NAT Exempt and inside interface all inside zone interface.


I already set up the access control, to block some website, here my access control configuration

source :

- zone = outside

- address = object network user vpn (50.x/24) 

- port = ANY

destination : 

- zone = ANY

- address = ANY

- port = ANY

application : 

- youtube

url filtering : 

- object url :,

action : block


But user vpn still can access twitter and youtube.

is there any solution for this case?



VIP Expert

Make sure the VPN IP address have access rules


here is the example video how you can block the URLS



*** Rate All Helpful Responses ***

Cisco NGFW Access-Policy - Configure a access policy to block Adult Categories. Note: this example is an interactive block.

@balaji.bandi I believe both and use both HTTP Strict Transport Security (HSTS) and Public Key Pinning (PKP). We can confirm this in Chrome via the query box at chrome://net-internals/#hsts

This creates a problem for a middleware box like Firepower since it cannot reliably intercept the traffic. For example, certificate SNI inspection doesn't work since uses * as its certificate.

The best and much more reliable way to block these clients is to use Cisco Umbrella which works by preventing the sites' DNS resolution and instead redirecting the client to a block page.


@Marvin Rhoads i can understand what you saying, but if the VPN Terminate in to FTD, (if the user do no have umbrella or other DNS Sec solution) - can we achieve this using ACL filtering with FQDN ( as per my understand FTD support this feature)


I do agree the video is bit away from this issue, The video just given example to understand how one can filter.


what would be the soluition or best approach, happy to hear / listen and understand what iam missing here ?






*** Rate All Helpful Responses ***


Sorry for the delay - I had on my list to test this. I just checked it in my lab and found that and were blocked just fine with a URL filtering ACP rule.

I noticed the original post had "youtube" application in the policy. When my client was blocked it was categorized as simply "https" application and "ssl client".

Here're the working policy and results for me:

ACP Rule blocking URLs.PNGBlock results.PNG

Content for Community-Ad