Imagine Bob, an innocent user on his lunch
break trying to go out to a website.
What's the problem with that?
Well, if we have a company policy that
says you are not allowed to go to certain types of websites
like pornography sites or gaming websites or sporting websites
or whatever it is, it'd be nice to both have the users agreed
to that with part of the acceptable policy
for how they're using the system,
and secondly to enforce it with technical controls
at the FirePOWER appliance so that if Bob
tries to go to one of those sites WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tries to go to one of those sites
in one of these categories, we can block it.
So in this Nugget, I'd like to talk about and demonstrate
URL filtering capabilities on the FirePOWER appliance.
For our demonstration, testing, and verification
of URL filtering based on URL categories,
let's imagine Bob sitting at this computer right
here on the inside of our network.
We'll set up the policy on the FTD appliance,
and for our demonstration let's create a policy as part
of our access control policy.
It says no websites that are in the category of sports. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It says no websites that are in the category of sports.
I don't know.
Maybe we have an anti sports company or something.
In any event, we can set up that policy here, have the FirePOWER
appliance, identify if Bob is ever
trying to go to a website that's categorized as sports,
and if so we can have the FirePOWER appliance drop
that traffic.
And one technique that I think we'll
find very effective in life as we work with computers
and networks and systems is test before, implement our policy,
and test after to make sure that we got the results that we're
expecting.
So let's bring up a browser on Bob's computer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's bring up a browser on Bob's computer.
And if somebody's asking the question, how come
Bob is running like Kali Linux?
That's a good question to ask.
In my lab environment it's just really
convenient for a lot of tools.
But an end user certainly should not
be using Kali Linux as their primary operating system.
That's a huge red flag.
All right.
And I've got to bookmark that we can use,
and that bookmark is for the top 15
most popular sports websites.
Yay.
And before we implement the URL filtering
policy against these types of websites,
I just want to pick a few and make sure that they work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I just want to pick a few and make sure that they work.
So let's go ahead and let's bring up Yahoo in a new tab.
Great.
That looks like it's working.
Fantastic.
And let's go ahead and grab ESPN, and that's working.
I love his face.
And I'll do one more.
I'll scroll down a little ways, and let's do NBC Sports.
OK, super.
So we're three for three.
All three of those sports websites come up, no problem
whatsoever from Bob's computer.
So now that we know that URLs based on sports WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now that we know that URLs based on sports
can be reached by Bob, let's go configure a policy
that's going to say otherwise.
So here at the FMC on the Overview tab
I was doing a little bit of testing
based on some euro filtering earlier and as
far as me sending traffic through the network,
it identified it and it's right here on this summary dashboard.
All right, FirePOWER.
Good job.
Way to keep track.
All right.
So what we're going to do is we're
going to click on Policies at the top
and then we're going to go to the access control policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then we're going to go to the access control policy
that FTD-1 is currently using, and that is our Starter Policy.
So we'll go ahead and click on Edit on the Starter Policy
and we're going to edit this access control policy
and we're going to add a new rule.
Now, to do that what we do is we can
take the first rule that's already there,
right click on it, and then simply select Insert New Rule.
And over here it tells us where it's going to put it.
So it's going to put the new rule below the line number one
or rule number one.
So that'll be the second position.
That'll work for us no problem.
And we'll call this rule No Sports. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll call this rule No Sports.
And for the action we're going to go ahead and block it
and we're going to include a TCP reset for those HTTP sessions
that are trying to go to sports based websites.
And for the zones instead of saying from anywhere
to anywhere we'll say traffic starting on the inside zone
and being routed out with interface in the outside zone.
And we can get granular, we can specify just Bob's computer,
or we could say anywhere in the 10 network.
So let's go ahead and do that.
So we'll say if it's coming from 10 anything WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll say if it's coming from 10 anything
and going to any IP address--
and what we're really after here is this tab right here
for URLs.
So if we want to scroll down this list of categories, what
we're looking for is sports.
All right, there we go.
And we'll go ahead and click on Add.
So that's going to reflect any website based
on sports is going to match this rule,
and the action is going to be block.
It's also going to do a TCP reset back to Bob's computer
whenever he tries to go to a website in this category. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
whenever he tries to go to a website in this category.
And also for good measure let's do logging.
So I'll click on the Logging tab and let's enable logging
as well so we can have those as connection events in our log
file.
And we'll click on Add.
All right.
So rule number two, no sports.
Looks great.
So we need to go ahead and save it.
So we'll click on Save and then we'll click on Deploy.
Make sure that FTD-1 is selected for deployment.
Right here it mentions what's going
to be changing on that device and we'll click on Deploy.
And then we'll give it a minute or two, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll give it a minute or two,
however long it takes for it to deploy that policy,
and we can check on the status any time
we want by clicking right here on the status icon
and then going to Tasks.
It's working on it.
And if we go to deployments here,
it also indicates that it's working on it.
So we'll let that finish, and once it's
done we'll go back to Bob's computer
and we'll see how many sports websites we can get to.
All right.
So this data says that it's currently deployed.
Let's go to Bob's computer.
Okie doke.
Here on Bob's computer I have the 15 most popular sports WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Here on Bob's computer I have the 15 most popular sports
websites based on this website saying what those top 15 are.
And let's try the same ones we tried before.
I know we tried Yahoo.
So we'll try Yahoo.
Wah.
And let's go back and try ESPN.
Wah.
And what was the other one?
NBC Sports I believe.
We'll try that one too, and that is not working.
That's fantastic.
Now, just for grins let's see if we
go to some other site like cisco.com, and that works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go to some other site like cisco.com, and that works.
Fantastic.
And if we wanted to try like a educational site like CBT
Nuggets we could try cbtnuggets.com,
and that's working.
So that's great verification that the URL filtering
that we figure out that is part of a rule in our access control
policy is actually working.
In this video, we configured and verified
URL filtering in FirePOWER.
I hope this has been informative for you,
and I'd like to thank you for viewing.