Block TLD’s (Top level domains)

[00uq6s92nAQyTe3t35d6]

Hi all,

We are trying to block TLD’s (Top level domains) within the FTD’s / FMC.   For example, we wish to block TLD’s that can pose threats such as RU, plus a few others. Currently, we have a rule built in the “Security Intelligence” to attempt a block these TLD’s, but it doesn’t work. We adjusted the Object group (txt file) to try male it block “RU”. Regardless of which way it was added e.g .RU or *RU or just RU, all failed and allowed the traffic to pass.

Is it possible for the FTD’s do even do this? Should such a rule be added to Access Control Policy, and not use the Security Intelligence?

Thanks

[FredrikW73]

The Access Control Policy works with IP addresses (single, range or subnet) and FQDNs. I don´t think it is possible to build policies from wildcarded addresses or names. A block based on wildcarded names/domains can be done in a surf proxy like the WSA.

Best option in FTD would be to block destination/source based on GeoLocation. You can block traffic to/from GeoLocation RUS as an example.

[hiddenuser]

The limitation with Geolocation block is that this uses the IP address of the web server host. In 2022-23, attackers are using legitimate services like Cloudflare to host phishing credential harvesting, but on sites that use .RU TLD. This is a common tactic. 

Cisco needs to provide guidance on how to block TLD's as other services like Zscaler now offer a specific feature for just such a purpose.

[Ken Stieers]

Create an incoming content filter with one action, drop.
Create a mail policy, at the top, with nothing enabled, except the one content filter. In that mail policy, add the senders for the TLDs want as @.tld, so @.ru, @.cn, etc.
A separate policy will mean this mail that you’re going to drop incurs no extra scanning load for domains that you’re just going to dump. You could do it with a message filter, and a dictionary, but this makes it “visible” in the gui.

[hiddenuser]

Hi Ken,

This post is regarding the FTD/FMC.. not the ESA. You are correct that it is very easy to block TLD's on the ESA.

I use this regex on the ESA which works great.

[^@]+@[^@]+\.id$

[Ken Stieers]

Heheh! Oooops, sorry!!!

[kleemisch]

Has anyone found a way to block these domains in ftd/fmc? Specifically .zip domains?

[network.admin01]

Yes, attach a DNS policy to the ACP and configure a rule using a custom DNS list by adding *.zip and *.mov to a new line in a .txt file and uploading it as a new object.

[00uq6s92nAQyTe3t35d6]

Will that work? Because I am sure the FMC wil not support wildcards.

Look here - Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 7.0 - Objects [Cisco Secure Firewall Threat Defense] - Cisco and under  Configuring Network Objects and Groups

I should add that, it will also depend on where your DNS sits. DNS may not be done by the Cisco FTD's.

[FredrikW73]

FMC may not support wildcards in adress objects but it does support wildcards in Security Intelligence lists.

Study the section about "Custom Security Intelligence Lists and Feeds" in the config guide.

I will try this tomorrow in my lab setup.

[network.admin01]

Yeah as you suggested. It works with Security Intelligence's DNS policy using a custom DNS list. Just set this up for .zip and .mov.

[ik752712]

Doesn't seems to work for me...

Are you doing DNS for the network on FTD or another device? What is the FMC/FTD software version?

[network.admin01]

DNS servers are Windows servers and the traffic is passing through the FTDs but DMZ servers resolving from the Internet are also working fine. Version 7.0.5 for both.

You need to make sure the correct ACP is applied to the FTDs with security intelligence DNS policy configured. Also the DNS traffic must go through the FTDs.

[FredrikW73]

I tested the suggestion to add a block via security intelligence, using a custom DNS list, in our lab setup (blocked *.ru).

The block works perfectly. I have tried a similar config using a custom URL list previously but that did not work.