Without URL Filtering wildcard support - any suggestions on how to do this?

[t-crisall]

I have found evidence of Web Proxy Audo-Discovery (WPAD) requests leaving my organization.  These come from BYOD machines brought onto my network which are outside of my control.  I am interested in blocking 'http://*/wpad.dat' and from my reading this appears impossible to achieve using URL filtering in a Firepower Access Control Policy.

Any thoughts or solutions?

Thanks!

[Marvin Rhoads]

You might possibly be able to block it via the sensitive data detection feature:

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/sensitive_data_detection.html#ID-2236-00000496

However that may cause performance issues with your firewall.

One alternative would be to specify a "dummy" wpad.dat in your DHCP server options. The clients should detect that and thus not try to use the DNS lookup.

https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol#Notes