Use Firepower to block http traffic that is running over tcp port 443?

[travwrig]

What is the way to block users from accessing HTTP websites that are running on tcp/443 instead of tcp/80?

[robert.harmon]

Your intrusion policy must be set to block.  You might want to look at the Configuration guides located on Cisco's support site:  http://www.cisco.com/c/en/us/support/security/defense-center/products-installation-and-configuration-guides-list.html for additional information.

Hope this helps.

[Marvin Rhoads · Accepted solution]

Yes. There is an optional setting in the preprocessor to "Detect Anomalous HTTP Servers".

Details for setting it can be found here:

http://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/application_layer_preprocessors.html#ID-2244-0000052b