Manual URL Filtering in Firepower
A few days ago, someone asked me the following two questions–
- Is a URL filtering license required to manually filter sites in Firepower?
- Are wildcards supported as filtering criteria?
The short answer to the first question is simply no. There is no requirement for a term-based URL filtering license to do manual filtering. The URL license enables filtering AND logging based on web categories and risks levels. If this license is not installed and attached to a Firepower device, any policy containing those elements cannot be deployed. However, URL filtering rules that contain only manual URLs can be applied and do function properly.
The second question requires a slightly longer answer. With URL filtering, Firepower considers the protocol, fqdn, path and filename. For example, the following is a URL for the article I wrote last Thursday.
http://www.packetu.com/2016/06/23/accessing-asa-cli-firepower-threat-defence/
For filtering purposes, any substring of the URL will match. So any of the following will block the above page.
packetu www.packetu.com 6 http w.packetu.com/2016/06/23/accessing
Obviously, care must be taken to make sure a rule isn’t overly broad. Very few people want to just filter “http” or “6”. Also worth noting, the URLs appear to be case desensitized and logged in lower case. Continue reading