We have installed the firepower management center in our Vmware Exsi in our sfr module 5.3.1. Our ASA is 5515-x version 9.2.2 and ASDM version 7.2.2. Management IP of ASA is 192.168.1.1 and the source fire defense center of firepower management center is 192.168.0.9 and we have installed the license for sfr module. But we don't have the url filtering license. Both are in different networks. Now, i don't see any connection of defense center with the ASA. How am i going to block traffic or do the url filtering this way? My requirements are simple and all i want is the ultimate solution for the url filtering. And we don't have url filtering license. How to filter the traffic?
On an ASA, you can block individual URLs in two different ways. The first way is using FQDN, which basically causes the ASA to resolve the hostname in DNS on a scheduled basis and update the ACL with the results of the lookup. So you create an ACL entry the denies traffic to the FQDN, and it will be updated with the DNS answers all the time.
The second way is to block the URL using regex patterns in
class-maps, tied to a
policy-map. This method will only work if the communication is over port 80.
In contrast, using Firepower, the URL license gives you a much more capable solution which is able to block URLs by category. One of the benefits to this method is that Cisco Talos is always providing updates to the URL database, so you can block entire genres of URLs with one click.
Now, you mention,
i don't see any connection of defense center with the ASA
On the Firepower sensor, run the command
show managers to see if the sensor is hooked up to the Management Center. If it's not hooked up, then you won't be able to control the sensor at all (on a 5515x), since the sensor receives its instructions from the Management Center. If it is connected to a manager, then HTTPS to the manager and login. If not, then follow the documentation to get the sensor connected to your FMC.