WEBVTT

1
00:00.000 --> 00:00.520 align:middle line:84%


2
00:00.520 --> 00:03.670 align:middle line:90%
Imagine Bob, an innocent
user on his lunch

3
00:03.670 --> 00:05.502 align:middle line:90%
break trying to go
out to a website.

4
00:05.502 --> 00:06.710 align:middle line:84%
What's the problem with that?

5
00:06.710 --> 00:08.980 align:middle line:90%
Well, if we have a
company policy that

6
00:08.980 --> 00:11.950 align:middle line:90%
says you are not allowed to go
to certain types of websites

7
00:11.950 --> 00:16.059 align:middle line:90%
like pornography sites or gaming
websites or sporting websites

8
00:16.059 --> 00:19.890 align:middle line:90%
or whatever it is, it'd be nice
to both have the users agreed

9
00:19.890 --> 00:21.945 align:middle line:90%
to that with part of
the acceptable policy

10
00:21.945 --> 00:23.320 align:middle line:90%
for how they're
using the system,

11
00:23.320 --> 00:26.560 align:middle line:90%
and secondly to enforce
it with technical controls

12
00:26.560 --> 00:29.380 align:middle line:90%
at the FirePOWER
appliance so that if Bob

13
00:29.380 --> 00:30.850 align:middle line:90%
tries to go to
one of those sites
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.380 --> 00:30.850 align:middle line:90%
tries to go to
one of those sites

14
00:30.850 --> 00:33.260 align:middle line:90%
in one of these categories,
we can block it.

15
00:33.260 --> 00:36.100 align:middle line:90%
So in this Nugget, I'd like
to talk about and demonstrate

16
00:36.100 --> 00:39.490 align:middle line:90%
URL filtering capabilities
on the FirePOWER appliance.

17
00:39.490 --> 00:42.010 align:middle line:90%
For our demonstration,
testing, and verification

18
00:42.010 --> 00:44.960 align:middle line:90%
of URL filtering based
on URL categories,

19
00:44.960 --> 00:47.320 align:middle line:90%
let's imagine Bob sitting
at this computer right

20
00:47.320 --> 00:49.080 align:middle line:90%
here on the inside
of our network.

21
00:49.080 --> 00:52.090 align:middle line:90%
We'll set up the policy
on the FTD appliance,

22
00:52.090 --> 00:54.880 align:middle line:90%
and for our demonstration
let's create a policy as part

23
00:54.880 --> 00:56.170 align:middle line:84%
of our access control policy.

24
00:56.170 --> 01:00.865 align:middle line:90%
It says no websites that are
in the category of sports.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:56.170 --> 01:00.865 align:middle line:90%
It says no websites that are
in the category of sports.

25
01:00.865 --> 01:01.500 align:middle line:84%
I don't know.

26
01:01.500 --> 01:04.030 align:middle line:90%
Maybe we have an anti
sports company or something.

27
01:04.030 --> 01:07.150 align:middle line:90%
In any event, we can set up that
policy here, have the FirePOWER

28
01:07.150 --> 01:09.130 align:middle line:90%
appliance, identify
if Bob is ever

29
01:09.130 --> 01:13.180 align:middle line:90%
trying to go to a website
that's categorized as sports,

30
01:13.180 --> 01:15.490 align:middle line:90%
and if so we can have the
FirePOWER appliance drop

31
01:15.490 --> 01:16.390 align:middle line:84%
that traffic.

32
01:16.390 --> 01:18.010 align:middle line:90%
And one technique
that I think we'll

33
01:18.010 --> 01:20.660 align:middle line:90%
find very effective in life
as we work with computers

34
01:20.660 --> 01:25.540 align:middle line:90%
and networks and systems is test
before, implement our policy,

35
01:25.540 --> 01:28.180 align:middle line:90%
and test after to make sure that
we got the results that we're

36
01:28.180 --> 01:29.050 align:middle line:84%
expecting.

37
01:29.050 --> 01:32.210 align:middle line:90%
So let's bring up a
browser on Bob's computer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.050 --> 01:32.210 align:middle line:90%
So let's bring up a
browser on Bob's computer.

38
01:32.210 --> 01:34.330 align:middle line:90%
And if somebody's asking
the question, how come

39
01:34.330 --> 01:36.640 align:middle line:84%
Bob is running like Kali Linux?

40
01:36.640 --> 01:38.027 align:middle line:84%
That's a good question to ask.

41
01:38.027 --> 01:39.610 align:middle line:90%
In my lab environment
it's just really

42
01:39.610 --> 01:41.320 align:middle line:84%
convenient for a lot of tools.

43
01:41.320 --> 01:43.210 align:middle line:90%
But an end user
certainly should not

44
01:43.210 --> 01:46.060 align:middle line:90%
be using Kali Linux as their
primary operating system.

45
01:46.060 --> 01:47.510 align:middle line:84%
That's a huge red flag.

46
01:47.510 --> 01:48.010 align:middle line:84%
All right.

47
01:48.010 --> 01:49.840 align:middle line:90%
And I've got to bookmark
that we can use,

48
01:49.840 --> 01:51.850 align:middle line:90%
and that bookmark
is for the top 15

49
01:51.850 --> 01:53.430 align:middle line:84%
most popular sports websites.

50
01:53.430 --> 01:54.190 align:middle line:84%
Yay.

51
01:54.190 --> 01:56.950 align:middle line:90%
And before we implement
the URL filtering

52
01:56.950 --> 01:59.320 align:middle line:90%
policy against these
types of websites,

53
01:59.320 --> 02:01.880 align:middle line:90%
I just want to pick a few
and make sure that they work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.320 --> 02:01.880 align:middle line:90%
I just want to pick a few
and make sure that they work.

54
02:01.880 --> 02:06.190 align:middle line:90%
So let's go ahead and let's
bring up Yahoo in a new tab.

55
02:06.190 --> 02:07.681 align:middle line:84%
Great.

56
02:07.681 --> 02:08.889 align:middle line:84%
That looks like it's working.

57
02:08.889 --> 02:10.150 align:middle line:84%
Fantastic.

58
02:10.150 --> 02:15.410 align:middle line:90%
And let's go ahead and grab
ESPN, and that's working.

59
02:15.410 --> 02:16.360 align:middle line:84%
I love his face.

60
02:16.360 --> 02:17.770 align:middle line:84%
And I'll do one more.

61
02:17.770 --> 02:21.910 align:middle line:90%
I'll scroll down a little
ways, and let's do NBC Sports.

62
02:21.910 --> 02:22.570 align:middle line:84%
OK, super.

63
02:22.570 --> 02:23.740 align:middle line:84%
So we're three for three.

64
02:23.740 --> 02:26.680 align:middle line:90%
All three of those sports
websites come up, no problem

65
02:26.680 --> 02:28.990 align:middle line:84%
whatsoever from Bob's computer.

66
02:28.990 --> 02:31.720 align:middle line:90%
So now that we know that
URLs based on sports
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:28.990 --> 02:31.720 align:middle line:90%
So now that we know that
URLs based on sports

67
02:31.720 --> 02:34.870 align:middle line:90%
can be reached by Bob,
let's go configure a policy

68
02:34.870 --> 02:37.190 align:middle line:84%
that's going to say otherwise.

69
02:37.190 --> 02:42.262 align:middle line:90%
So here at the FMC
on the Overview tab

70
02:42.262 --> 02:43.720 align:middle line:90%
I was doing a little
bit of testing

71
02:43.720 --> 02:46.600 align:middle line:90%
based on some euro
filtering earlier and as

72
02:46.600 --> 02:48.980 align:middle line:90%
far as me sending traffic
through the network,

73
02:48.980 --> 02:52.210 align:middle line:90%
it identified it and it's right
here on this summary dashboard.

74
02:52.210 --> 02:53.290 align:middle line:84%
All right, FirePOWER.

75
02:53.290 --> 02:53.860 align:middle line:84%
Good job.

76
02:53.860 --> 02:54.670 align:middle line:84%
Way to keep track.

77
02:54.670 --> 02:55.240 align:middle line:84%
All right.

78
02:55.240 --> 02:56.657 align:middle line:90%
So what we're going
to do is we're

79
02:56.657 --> 02:58.670 align:middle line:90%
going to click on
Policies at the top

80
02:58.670 --> 03:00.970 align:middle line:90%
and then we're going to go
to the access control policy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.670 --> 03:00.970 align:middle line:90%
and then we're going to go
to the access control policy

81
03:00.970 --> 03:04.970 align:middle line:90%
that FTD-1 is currently using,
and that is our Starter Policy.

82
03:04.970 --> 03:08.920 align:middle line:90%
So we'll go ahead and click
on Edit on the Starter Policy

83
03:08.920 --> 03:11.500 align:middle line:90%
and we're going to edit
this access control policy

84
03:11.500 --> 03:13.270 align:middle line:90%
and we're going
to add a new rule.

85
03:13.270 --> 03:15.160 align:middle line:90%
Now, to do that
what we do is we can

86
03:15.160 --> 03:17.080 align:middle line:90%
take the first rule
that's already there,

87
03:17.080 --> 03:20.592 align:middle line:90%
right click on it, and then
simply select Insert New Rule.

88
03:20.592 --> 03:22.800 align:middle line:90%
And over here it tells us
where it's going to put it.

89
03:22.800 --> 03:25.780 align:middle line:90%
So it's going to put the new
rule below the line number one

90
03:25.780 --> 03:26.643 align:middle line:84%
or rule number one.

91
03:26.643 --> 03:28.060 align:middle line:90%
So that'll be the
second position.

92
03:28.060 --> 03:29.830 align:middle line:84%
That'll work for us no problem.

93
03:29.830 --> 03:33.490 align:middle line:90%
And we'll call this
rule No Sports.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:29.830 --> 03:33.490 align:middle line:90%
And we'll call this
rule No Sports.

94
03:33.490 --> 03:36.640 align:middle line:90%
And for the action we're
going to go ahead and block it

95
03:36.640 --> 03:40.030 align:middle line:90%
and we're going to include a TCP
reset for those HTTP sessions

96
03:40.030 --> 03:42.848 align:middle line:90%
that are trying to go to
sports based websites.

97
03:42.848 --> 03:44.890 align:middle line:90%
And for the zones instead
of saying from anywhere

98
03:44.890 --> 03:48.520 align:middle line:90%
to anywhere we'll say traffic
starting on the inside zone

99
03:48.520 --> 03:51.370 align:middle line:90%
and being routed out with
interface in the outside zone.

100
03:51.370 --> 03:54.910 align:middle line:90%
And we can get granular, we can
specify just Bob's computer,

101
03:54.910 --> 03:57.720 align:middle line:90%
or we could say anywhere
in the 10 network.

102
03:57.720 --> 03:58.970 align:middle line:84%
So let's go ahead and do that.

103
03:58.970 --> 04:01.120 align:middle line:90%
So we'll say if it's
coming from 10 anything
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.970 --> 04:01.120 align:middle line:90%
So we'll say if it's
coming from 10 anything

104
04:01.120 --> 04:03.080 align:middle line:84%
and going to any IP address--

105
04:03.080 --> 04:05.560 align:middle line:90%
and what we're really after
here is this tab right here

106
04:05.560 --> 04:07.120 align:middle line:84%
for URLs.

107
04:07.120 --> 04:09.550 align:middle line:90%
So if we want to scroll down
this list of categories, what

108
04:09.550 --> 04:15.520 align:middle line:84%
we're looking for is sports.

109
04:15.520 --> 04:17.149 align:middle line:84%
All right, there we go.

110
04:17.149 --> 04:19.420 align:middle line:90%
And we'll go ahead
and click on Add.

111
04:19.420 --> 04:21.550 align:middle line:90%
So that's going to
reflect any website based

112
04:21.550 --> 04:24.160 align:middle line:90%
on sports is going
to match this rule,

113
04:24.160 --> 04:26.410 align:middle line:90%
and the action is
going to be block.

114
04:26.410 --> 04:29.620 align:middle line:90%
It's also going to do a TCP
reset back to Bob's computer

115
04:29.620 --> 04:32.320 align:middle line:90%
whenever he tries to go to
a website in this category.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:29.620 --> 04:32.320 align:middle line:90%
whenever he tries to go to
a website in this category.

116
04:32.320 --> 04:34.210 align:middle line:90%
And also for good
measure let's do logging.

117
04:34.210 --> 04:37.030 align:middle line:90%
So I'll click on the Logging
tab and let's enable logging

118
04:37.030 --> 04:40.520 align:middle line:90%
as well so we can have those
as connection events in our log

119
04:40.520 --> 04:41.020 align:middle line:84%
file.

120
04:41.020 --> 04:42.710 align:middle line:84%
And we'll click on Add.

121
04:42.710 --> 04:43.210 align:middle line:84%
All right.

122
04:43.210 --> 04:45.520 align:middle line:84%
So rule number two, no sports.

123
04:45.520 --> 04:46.210 align:middle line:84%
Looks great.

124
04:46.210 --> 04:47.810 align:middle line:90%
So we need to go
ahead and save it.

125
04:47.810 --> 04:51.840 align:middle line:90%
So we'll click on Save and
then we'll click on Deploy.

126
04:51.840 --> 04:54.852 align:middle line:90%
Make sure that FTD-1 is
selected for deployment.

127
04:54.852 --> 04:56.310 align:middle line:90%
Right here it
mentions what's going

128
04:56.310 --> 04:59.970 align:middle line:90%
to be changing on that device
and we'll click on Deploy.

129
04:59.970 --> 05:01.890 align:middle line:90%
And then we'll give
it a minute or two,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:59.970 --> 05:01.890 align:middle line:90%
And then we'll give
it a minute or two,

130
05:01.890 --> 05:04.615 align:middle line:90%
however long it takes for
it to deploy that policy,

131
05:04.615 --> 05:06.240 align:middle line:90%
and we can check on
the status any time

132
05:06.240 --> 05:08.910 align:middle line:90%
we want by clicking right
here on the status icon

133
05:08.910 --> 05:10.530 align:middle line:84%
and then going to Tasks.

134
05:10.530 --> 05:11.480 align:middle line:84%
It's working on it.

135
05:11.480 --> 05:12.930 align:middle line:90%
And if we go to
deployments here,

136
05:12.930 --> 05:14.725 align:middle line:90%
it also indicates that
it's working on it.

137
05:14.725 --> 05:16.350 align:middle line:90%
So we'll let that
finish, and once it's

138
05:16.350 --> 05:18.820 align:middle line:90%
done we'll go back
to Bob's computer

139
05:18.820 --> 05:21.730 align:middle line:90%
and we'll see how many sports
websites we can get to.

140
05:21.730 --> 05:22.230 align:middle line:84%
All right.

141
05:22.230 --> 05:24.620 align:middle line:90%
So this data says that
it's currently deployed.

142
05:24.620 --> 05:26.660 align:middle line:84%
Let's go to Bob's computer.

143
05:26.660 --> 05:27.160 align:middle line:84%
Okie doke.

144
05:27.160 --> 05:30.660 align:middle line:90%
Here on Bob's computer I have
the 15 most popular sports
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:27.160 --> 05:30.660 align:middle line:90%
Here on Bob's computer I have
the 15 most popular sports

145
05:30.660 --> 05:34.350 align:middle line:90%
websites based on this website
saying what those top 15 are.

146
05:34.350 --> 05:36.540 align:middle line:90%
And let's try the same
ones we tried before.

147
05:36.540 --> 05:38.070 align:middle line:84%
I know we tried Yahoo.

148
05:38.070 --> 05:39.630 align:middle line:84%
So we'll try Yahoo.

149
05:39.630 --> 05:41.610 align:middle line:84%
Wah.

150
05:41.610 --> 05:45.230 align:middle line:84%
And let's go back and try ESPN.

151
05:45.230 --> 05:48.420 align:middle line:84%
Wah.

152
05:48.420 --> 05:50.160 align:middle line:84%
And what was the other one?

153
05:50.160 --> 05:51.970 align:middle line:84%
NBC Sports I believe.

154
05:51.970 --> 05:54.960 align:middle line:90%
We'll try that one too,
and that is not working.

155
05:54.960 --> 05:55.710 align:middle line:84%
That's fantastic.

156
05:55.710 --> 05:57.168 align:middle line:90%
Now, just for grins
let's see if we

157
05:57.168 --> 06:01.320 align:middle line:90%
go to some other site like
cisco.com, and that works.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
05:57.168 --> 06:01.320 align:middle line:90%
go to some other site like
cisco.com, and that works.

158
06:01.320 --> 06:02.310 align:middle line:84%
Fantastic.

159
06:02.310 --> 06:05.610 align:middle line:90%
And if we wanted to try like
a educational site like CBT

160
06:05.610 --> 06:08.958 align:middle line:90%
Nuggets we could
try cbtnuggets.com,

161
06:08.958 --> 06:09.750 align:middle line:84%
and that's working.

162
06:09.750 --> 06:13.140 align:middle line:90%
So that's great verification
that the URL filtering

163
06:13.140 --> 06:15.900 align:middle line:90%
that we figure out that is part
of a rule in our access control

164
06:15.900 --> 06:18.180 align:middle line:84%
policy is actually working.

165
06:18.180 --> 06:20.790 align:middle line:90%
In this video, we
configured and verified

166
06:20.790 --> 06:23.190 align:middle line:84%
URL filtering in FirePOWER.

167
06:23.190 --> 06:25.200 align:middle line:90%
I hope this has been
informative for you,

168
06:25.200 --> 06:28.370 align:middle line:90%
and I'd like to thank
you for viewing.