I have a Cisco ASA 5515, and I have configured as follows:

ASA Version 9.2(2)4   

hostname ciscoasa  
enable password ********* encrypted  
interface GigabitEthernet0/0  
 nameif Public-IP  
 security-level 0  
 ip address   
interface GigabitEthernet0/1  
 nameif CC-Camera  
 security-level 50  
 ip address   
interface GigabitEthernet0/2  
 nameif Computer-Lab  
 security-level 90  
 ip address  
interface GigabitEthernet0/3             
 nameif Private-LAN  
 security-level 100  
 ip address   
interface GigabitEthernet0/4             
 nameif Wireless  
 security-level 80  
 ip address  
interface GigabitEthernet0/5  
 no nameif  
 no security-level  
 no ip address  
interface Management0/0  
 nameif management  
 security-level 100  
 ip address   
boot system disk0:/asa922-4-smp-k8.bin  
ftp mode passive  

object network CC-Camera-subnet  
object network Computer-Lab  
object network Private-LAN  
object network Wireless  

object network CC-Camera-subnet  
 nat (CC-Camera,Public-IP) dynamic interface  
object network Computer-Lab  
 nat (Computer-Lab,Public-IP) dynamic interface   
object network Private-LAN  
 nat (Private-LAN,Public-IP) dynamic interface  
object network Wireless  
 nat (Wireless,Public-IP) dynamic interface  
access-group Public-IP_access_in in interface Public-IP  
access-group CC-Camera_access_in in interface CC-Camera  

route Public-IP x.x.x.x

timeout xlate 3:00:00  
timeout pat-xlate 0:00:30  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
timeout floating-conn 0:00:00  

dynamic-access-policy-record DfltAccessPolicy  

user-identity default-domain LOCAL  

http server enable  
http management  

no snmp-server location  
no snmp-server contact  

crypto ipsec security-association pmtu-aging infinite  
crypto ca trustpool policy  

telnet timeout 5  
no ssh stricthostkeycheck  
ssh timeout 5  
ssh key-exchange group dh-group1-sha1  
console timeout 0  

dhcpd address management  
dhcpd enable management  
threat-detection basic-threat   
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  

ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1  
class-map inspection_default  
 match default-inspection-traffic  
policy-map type inspect dns preset_dns_map  
  message-length maximum client auto  
  message-length maximum 512  

policy-map global_policy  
 class inspection_default  
  inspect dns preset_dns_map   
  inspect ftp   
  inspect h323 h225   
  inspect h323 ras   
  inspect rsh   
  inspect rtsp   
  inspect esmtp  
  inspect sqlnet  
  inspect skinny   
  inspect sunrpc  
  inspect xdmcp  
  inspect sip   

My issue is as follows:

My client wants Facebook, YouTube, torrents, etc. to be blocked. How can I do so using ASDM?

ciscoasa(config)# sh module

Mod  Card Type                                    Model              Serial No. 
---- -------------------------------------------- ------------------ -----------
   0 ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC ASA5515            FCH200571ES
 ips Unknown                                      N/A                FCH200571ES
cxsc Unknown                                      N/A                FCH200571ES
 sfr FirePOWER Services Software Module           ASA5515            FCH200571ES

Mod  MAC Address Range                 Hw Version   Fw Version   Sw Version     
---- --------------------------------- ------------ ------------ ---------------
   0 00c8.8bd3.9f63 to 00c8.8bd3.9f6a  1.0          2.1(9)8      9.2(2)4
 ips 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          
cxsc 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          
 sfr 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          5.3.1-152

Mod  SSM Application Name           Status           SSM Application Version
---- ------------------------------ ---------------- --------------------------
 ips Unknown                        No Image Present Not Applicable
cxsc Unknown                        No Image Present Not Applicable
 sfr ASA FirePOWER                  Up               5.3.1-152

Mod  Status             Data Plane Status     Compatibility
---- ------------------ --------------------- -------------
   0 Up Sys             Not Applicable        
 ips Unresponsive       Not Applicable        
<--- More --->

cxsc Unresponsive       Not Applicable        
 sfr Up                 Up                    

Mod  License Name   License Status  Time Remaining
---- -------------- --------------- ---------------
 ips IPS Module     Disabled        perpetual     

As there is firepower module status up, I am hoping we can block certain websites, but I couldn't see the options to do so.

  • Side note: if you have a support contract you can upgrade to version 9.6(1) / ASDM 7.6(1). Event with you current version the recommended ASDM version is 7.6(1).
    – JFL
    Apr 28, 2016 at 8:28
  • In what way that will be helpful @JFL?
    – de.walkar
    Apr 28, 2016 at 8:32
  • No one helped me. This was the first time i didn't get my queries assisted. Anyway, i found the solution and the reason why my NAT didn't work was because of the ACL i have configured. For going to upper security level to lower security level, we don't need to configure ACL, NAT is enough for that. Now, i have problem blocking facebook,youtube and so on. And yes i have firepower licence as well. Hope help is on the way.
    – de.walkar
    Apr 29, 2016 at 15:51
  • Don't cry. You're asking multiple questions at once. That's a bad question style. Please learn, [how to ask a good question] (stackoverflow.com/help/how-to-ask). Apr 30, 2016 at 16:20
  • You may need to apply some creative reasoning to this and obtain the IP addresses to the desired sites you wish to restrict. Once that is done it is as easy as creating the rules in ASDM.
    – Ty Smith
    Jul 1, 2016 at 8:20

3 Answers 3


Your question is how to configure the Sourcefire IPS via the Sourfire Management Center to block certain sites.

URL Filtering on a FireSIGHT System Configuration Example

Exclusion of a Specific Site from Blocked URL Category

FireSIGHT Management Center does not allow you to have a local rating of URLs that override the default Sourcefire provided category ratings. In order to accomplish this task, you must use an Access Control policy. These instructions describe how to use a URL object in an Access Control rule in order to exclude a specific site from a block category. Navigate to Objects > Object Management page.

Select Individual Objects for URL, and click the Add URL button. The URL Objects window appears. enter image description here enter image description here


Actually, the only way to block traffic in cisco ASA is to use the defence center with the SFR module in my case. What i did is: 1. Downloaded the latest defence center (firepower management center) from the cisco website. 2.since i am using 5515-x ASA so my ASA would not support ASDM itself to provide the function of DC. 3. I used my server to host the DC and linked that DC with the SFR module in the ASA. 4. Now, i can use the DC to block/allow whatever traffic i want. But having said that, i use manual url blocking which can still be achieved without buying the url filtering license.


With the ASA5515 you need the SFR module to be on 6.X in order to manage it with ASDM. Currently it shows as being on 5.3 so you'll have to upgrade it to use ASDM for management. Otherwise you need to use FireSIGHT Management Center to manage the SFR module.

Once you are able to manage the SFR you can block those sites by Web Application type (requires CONTROL license which comes with the SFR module) or you can block by URL (requires the URL license).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.