How to configure a Cisco ASA using ASDM to block/allow traffic like websites,IP etc.?

Question

I have a Cisco ASA 5515, and I have configured as follows:

ASA Version 9.2(2)4   

hostname ciscoasa  
enable password ********* encrypted  
names  
!  
interface GigabitEthernet0/0  
 nameif Public-IP  
 security-level 0  
 ip address 202.67.23.37 255.255.255.0   
!  
interface GigabitEthernet0/1  
 nameif CC-Camera  
 security-level 50  
 ip address 10.10.20.1 255.255.255.0   
!  
interface GigabitEthernet0/2  
 nameif Computer-Lab  
 security-level 90  
 ip address 10.10.21.1 255.255.255.0  
!         
interface GigabitEthernet0/3             
 nameif Private-LAN  
 security-level 100  
 ip address 10.10.22.1 255.255.255.0   
!  
interface GigabitEthernet0/4             
 nameif Wireless  
 security-level 80  
 ip address 10.10.23.1 255.255.255.0  
!  
interface GigabitEthernet0/5  
 shutdown  
 no nameif  
 no security-level  
 no ip address  
!  
interface Management0/0  
 management-only  
 nameif management  
 security-level 100  
 ip address 192.168.1.1 255.255.255.0   
!  
boot system disk0:/asa922-4-smp-k8.bin  
ftp mode passive  

object network CC-Camera-subnet  
 subnet 10.10.20.0 255.255.255.0  
object network Computer-Lab  
 subnet 10.10.21.0 255.255.255.0  
object network Private-LAN  
 subnet 10.10.22.0 255.255.255.0  
object network Wireless  
 subnet 10.10.23.0 255.255.255.0  

!  
object network CC-Camera-subnet  
 nat (CC-Camera,Public-IP) dynamic interface  
object network Computer-Lab  
 nat (Computer-Lab,Public-IP) dynamic interface   
object network Private-LAN  
 nat (Private-LAN,Public-IP) dynamic interface  
object network Wireless  
 nat (Wireless,Public-IP) dynamic interface  
access-group Public-IP_access_in in interface Public-IP  
access-group CC-Camera_access_in in interface CC-Camera  

route Public-IP 0.0.0.0 0.0.0.0 x.x.x.x

timeout xlate 3:00:00  
timeout pat-xlate 0:00:30  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
timeout floating-conn 0:00:00  

dynamic-access-policy-record DfltAccessPolicy  

user-identity default-domain LOCAL  

http server enable  
http 192.168.1.0 255.255.255.0 management  

no snmp-server location  
no snmp-server contact  

crypto ipsec security-association pmtu-aging infinite  
crypto ca trustpool policy  

telnet timeout 5  
no ssh stricthostkeycheck  
ssh timeout 5  
ssh key-exchange group dh-group1-sha1  
console timeout 0  

dhcpd address 192.168.1.2-192.168.1.254 management  
dhcpd enable management  
!
threat-detection basic-threat   
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  

ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1  
!  
class-map inspection_default  
 match default-inspection-traffic  
!  
policy-map type inspect dns preset_dns_map  
 parameters  
  message-length maximum client auto  
  message-length maximum 512  

policy-map global_policy  
 class inspection_default  
  inspect dns preset_dns_map   
  inspect ftp   
  inspect h323 h225   
  inspect h323 ras   
  inspect rsh   
  inspect rtsp   
  inspect esmtp  
  inspect sqlnet  
  inspect skinny   
  inspect sunrpc  
  inspect xdmcp  
  inspect sip   

My issue is as follows:

My client wants Facebook, YouTube, torrents, etc. to be blocked. How can I do so using ASDM?

ciscoasa(config)# sh module

Mod  Card Type                                    Model              Serial No. 
---- -------------------------------------------- ------------------ -----------
   0 ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC ASA5515            FCH200571ES
 ips Unknown                                      N/A                FCH200571ES
cxsc Unknown                                      N/A                FCH200571ES
 sfr FirePOWER Services Software Module           ASA5515            FCH200571ES

Mod  MAC Address Range                 Hw Version   Fw Version   Sw Version     
---- --------------------------------- ------------ ------------ ---------------
   0 00c8.8bd3.9f63 to 00c8.8bd3.9f6a  1.0          2.1(9)8      9.2(2)4
 ips 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          
cxsc 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          
 sfr 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          5.3.1-152

Mod  SSM Application Name           Status           SSM Application Version
---- ------------------------------ ---------------- --------------------------
 ips Unknown                        No Image Present Not Applicable
cxsc Unknown                        No Image Present Not Applicable
 sfr ASA FirePOWER                  Up               5.3.1-152

Mod  Status             Data Plane Status     Compatibility
---- ------------------ --------------------- -------------
   0 Up Sys             Not Applicable        
 ips Unresponsive       Not Applicable        
<--- More --->

cxsc Unresponsive       Not Applicable        
 sfr Up                 Up                    

Mod  License Name   License Status  Time Remaining
---- -------------- --------------- ---------------
 ips IPS Module     Disabled        perpetual     

As there is firepower module status up, I am hoping we can block certain websites, but I couldn't see the options to do so.

Answer 1

Your question is how to configure the Sourcefire IPS via the Sourfire Management Center to block certain sites.

URL Filtering on a FireSIGHT System Configuration Example

Exclusion of a Specific Site from Blocked URL Category

FireSIGHT Management Center does not allow you to have a local rating of URLs that override the default Sourcefire provided category ratings. In order to accomplish this task, you must use an Access Control policy. These instructions describe how to use a URL object in an Access Control rule in order to exclude a specific site from a block category. Navigate to Objects > Object Management page.

Select Individual Objects for URL, and click the Add URL button. The URL Objects window appears.

Answer 2

Actually, the only way to block traffic in cisco ASA is to use the defence center with the SFR module in my case. What i did is: 1. Downloaded the latest defence center (firepower management center) from the cisco website. 2.since i am using 5515-x ASA so my ASA would not support ASDM itself to provide the function of DC. 3. I used my server to host the DC and linked that DC with the SFR module in the ASA. 4. Now, i can use the DC to block/allow whatever traffic i want. But having said that, i use manual url blocking which can still be achieved without buying the url filtering license.

Answer 3

With the ASA5515 you need the SFR module to be on 6.X in order to manage it with ASDM. Currently it shows as being on 5.3 so you'll have to upgrade it to use ASDM for management. Otherwise you need to use FireSIGHT Management Center to manage the SFR module.

Once you are able to manage the SFR you can block those sites by Web Application type (requires CONTROL license which comes with the SFR module) or you can block by URL (requires the URL license).