1

We have installed the firepower management center in our Vmware Exsi in our sfr module 5.3.1. Our ASA is 5515-x version 9.2.2 and ASDM version 7.2.2. Management IP of ASA is 192.168.1.1 and the source fire defense center of firepower management center is 192.168.0.9 and we have installed the license for sfr module. But we don't have the url filtering license. Both are in different networks. Now, i don't see any connection of defense center with the ASA. How am i going to block traffic or do the url filtering this way? My requirements are simple and all i want is the ultimate solution for the url filtering. And we don't have url filtering license. How to filter the traffic?

  • 3
    Buy the license? – Ron Maupin May 8 '16 at 16:32
  • Is there no way to do filtering without url license? @ Ron. – de.walkar May 9 '16 at 1:20
1

On an ASA, you can block individual URLs in two different ways. The first way is using FQDN, which basically causes the ASA to resolve the hostname in DNS on a scheduled basis and update the ACL with the results of the lookup. So you create an ACL entry the denies traffic to the FQDN, and it will be updated with the DNS answers all the time.

The second way is to block the URL using regex patterns in class-maps, tied to a policy-map. This method will only work if the communication is over port 80.

In contrast, using Firepower, the URL license gives you a much more capable solution which is able to block URLs by category. One of the benefits to this method is that Cisco Talos is always providing updates to the URL database, so you can block entire genres of URLs with one click.

Now, you mention,

i don't see any connection of defense center with the ASA

On the Firepower sensor, run the command show managers to see if the sensor is hooked up to the Management Center. If it's not hooked up, then you won't be able to control the sensor at all (on a 5515x), since the sensor receives its instructions from the Management Center. If it is connected to a manager, then HTTPS to the manager and login. If not, then follow the documentation to get the sensor connected to your FMC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.