Configure and Verify URL Filtering

Available Languages

Download Options

PDF (2.2 MB)
View with Adobe Reader on a variety of devices
ePub (2.3 MB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (2.0 MB)
View on Kindle device or Kindle app on multiple devices

Updated:August 7, 2024

Document ID:222285

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Configure Components for URL-Filtering Policy

Create URL Lists of Interest

Create Security Policy

Apply a Security Policy to a Device

Modify URL Flitering

Delete URL Filtering

Verify

Monitor URL Filtering From vManage GUI

Troubleshoot

Related Information

Introduction

This document describes how to configure and verify URL Filtering on CIsco IOS-XE® routers using Cisco Catalyst Manager GUI.

Prerequisites

Upload compatible UTD Software virtual image with the current Cisco IOS-XE code in vManage. Please check the Releated information section for instructions on how to install the UTD Security Virtual Image on cEdge Routers.

Cisco Edge router must be on vManaged mode with template pre attached.

Requirements

Cisco recommends that you have knowledge of these topics:

Cisco SD-WAN Overlay bring up with initial configuration.
URL Filtering configuration Cisco Catalyst Manager GUI.

Components Used

This document is based on these software and hardware versions:

Cisco Catalyst SD-WAN Manager version 20.14.1.
Cisco Catalyst SD-WAN Controller version 20.14.1.
Cisco Edge Router version 17.14.1.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Configure

Network Diagram

Configure Components for URL-Filtering Policy

This article explains how to configure URL-Filtering to block/allow certain client HTTPS traffic based on category, reputation, or by domain block/allow lists given these example requirements:

Block this HTTPS requests from clients on the guest VPN web categories:

Games
Gambling
Hacking
Illegal drugs

Any HTTPS URL request to websites from client on guest VPN with a web reputation less than and equal to 60 must be blocked.

HTTP(s) requests to websites from clients on the guest VPN block Facebook, Instagram, and YouTube, while allowing access to google.com and yahoo.com.

To configure URL Filtering:

Create URL Lists of Interest

On the Cisco SD-WAN Manager menu, navigate to Configuration > Security tab in the left side panel.

Cisco SD-WAN Manager

To create or manage Allowlist URL List or Blocklist URL List, select Lists from the Custom Options drop-down menu at the top right of the page.

To Create or Manage Allow or Block URL Lists

Click on Allow URLs Lists from the left pane and create New Allow URL List.

Click Allow URL Lists

In the URL List Name field, enter a list name consisting of up to 32 characters (letters, numbers, hyphens and underscores only).
In the URL field, enter URLs to include in the list, separated with commas. You also can use the Import button to add lists from an accessible storage location.
Click Add when you are finished.

Enter URL lists in Allow URL List

Note: You can consider using a regex pattern for the domain name in allow and block lists

Click on Block URLs Lists from the left pane and create New Block URL List.

Click Block URL List

In the URL List Name field, enter a list name consisting of up to 32 characters (letters, numbers, hyphens and underscores only)
In the URL field, enter URLs to include in the list, separated with commas. You also can use the Import button to add lists from an accessible storage location.
Click Add when you are finished.

Enter URL lists in Block URL List

Create Security Policy

2. On the Cisco SD-WAN Manager menu, navigate to Configuration > Security Click on Add new security policy. The Add Security Policy wizard opens and various use-case scenarios are displayed or use existing policy from the list. Select custom, Click Proceed to add a URL filtering policy in the wizard.

Create Security Policy

Note: In Add Security Policy, choose a scenario that supports URL filtering (Guest Access, Direct Internet Access, or Custom).

In the Add Security Policy wizard, click Next until the URL Filtering window is displayed. Now create a URL Filtering policy by going to URL Filtering > Add URL Filtering Policy > Create New. Click Next

Click Create New

Click Target VPNs to add the required number of VPNs in the Add Target VPNs wizard.

Click Target VPNs

Enter a policy name in the Policy Name field.
Choose one of these options from the Web Categories drop-down, select Block and the websites that match the categories that you choose are blocked.

Block—Block websites that match the categories that you select.
Allow—Allow websites that match the categories that you select.

Choose a Web Reputation from the drop-down menu and set to Moderate Risk. Any URL that has a reputation score of 60 or lower is blocked.

High Risk: Reputation score of 0 to 20.
Suspicious: Reputation score of 0 to 40.
Moderate Risk: Reputation score of 0 to 60.
Low Risk: Reputation score of 0 to 80.
Trustworthy: Reputation score of 0 to 100.

Enter Policy Name and Rules

From Advanced, choose existing lists or create new list as needed from the Allowlist URL List or blocklist URL List drop-down menu.

Under Advanced, Choose Existing Lists in Whitelist URL List

Choose Existing Lists in Blacklist URL List

If needed, change content body under Block Page Content and make sure all the Alerts are selected.

Click Save URL filtering Policy to add an URL filtering policy.

Click Save URL Filtering Policy

Click Next until the Policy Summary page is displayed.

Enter Security Policy Name and Security Policy Description in the respective fields.

Enter Policy Name and Description.Click Save Policy.

Apply a Security Policy to a Device

To apply a security policy to a device:

From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

Apply Security Policy to Device, Click Templates

Click Device Templates and Click on Edit on Device Template.

Edit Device Template.

Click Additional Templates.

Click Additional Templates.

From the Security Policy drop-down list, choose the name of the policy you configure under Guest_URL_Policy previously and Click Update.

Add the URL policy in Security Policy

Click on devices, and make sure the config is correct and Click Config Diff and Side by Side Diff. Click Configure Devices.

Click Devices and Config Diff

Verify Config is Correct

Make sure config is correct.

vManage successfully configured the device template with the security policy and installed the UTD package on the Edge device.

vManage Successfully configured device template with the Security Policy.

Modify URL Flitering

To modify a URL Filtering policy, do these steps:

From the Cisco SD-WAN Manager menu, choose Configuration > Security.
In the Security screen, click the Custom Options drop-down menu , choose Policies/Profiles.

To modify URL Filtering.

Click on URL Filtering on the left tab, for the desired policy you want to modify, clickon 3 dots (...)and choose Edit.

Click on Url Filtering.

Modify the policy as required and click Save URL Filtering Policy.

Modify the policy and Click Save URL Filtering Policy.

Delete URL Filtering

To delete a URL filtering policy, you must first detach the policy from the security policy:

From the Cisco SD-WAN Manager menu, choose Configuration > Security.

To detach the URL filtering policy from the security policy:

For the security policy that contains the URL filtering policy, click 3 dots (...) then click Edit.

To Delete URL Filtering.

The Policy Summary page is displayed. Click URL Filtering tab.

For the policy that you want to delete, click 3 dots (...) then choose Detach.

Click Save Policy Changes.

Click Detach and Save Policy Changes.

To delete the URL filtering policy:

In the Security screen, click the Custom Options drop-down menu , choose Policies/Profiles, and then choose URL Filtering.

Click Policies/Profiles and select URL filtering.

For the policy that you want to delete, click 3 dots (...) then click Delete.

Click on OK.

Click Delete.

Click OK.

Verify

Verify whether the Cisco UTD version is installed.

Site300-cE1#show utd engine standard version
UTD Virtual-service Name: utd
IOS-XE Recommended UTD Version: 1.0.2_SV3.1.67.0_XE17.14
IOS-XE Supported UTD Regex: ^1\.0\.([0-9]+)_SV(.*)_XE17.14$
UTD Installed Version: 1.0.2_SV3.1.67.0_XE17.14

From the client PC located on the Guest VPN, if you try to open google.com and yahoo.com, they are allowed.

From client PC on Guest VPN, try to open google.com.

Site300-cE1#show utd engine standard logging events | in google
2024/07/24-13:22:38.900508 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Pass [**] UTD WebFilter Allowlist [**] [URL: www.google.com] [VRF: 12] {TCP} 10.32.1.10:55310 -> 142.250.189.196:443
2024/07/24-13:24:03.429964 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Pass [**] UTD WebFilter Allowlist [**] [URL: www.google.com] [VRF: 12] {TCP} 10.32.1.10:55350 -> 142.250.189.196:443

From client PC on Guest VPN, try to open yahoo.com.

Site300-cE1#show utd engine standard logging events | in yahoo
2024/07/24-13:20:45.238251 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Pass [**] UTD WebFilter Allowlist [**] [URL: www.yahoo.com] [VRF: 12] {TCP} 10.32.1.10:48714 -> 69.147.88.8:443
2024/07/24-13:20:45.245446 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Pass [**] UTD WebFilter Allowlist [**] [URL: www.yahoo.com] [VRF: 12] {TCP} 10.32.1.10:48716 -> 69.147.88.8:443

From the client PC located on the Guest VPN, if you try to open web pages with low reputation scores or from one of the blocked web categories, the URL Filtering Engine denies the HTTPs request.

From client PC on Guest VPN, try to open malware.wicar.org.

Site300-cE1#show utd engine standard logging events | in mal
2024/07/24-13:32:18.475318 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter Category/Reputation [**] [URL: malware.wicar.org/data/firefox_proto_crmfrequest.html] ** [Category: Malware Sites] ** [Reputation: 10] [VRF: 12] {TCP} 10.32.1.10:40154 -> 208.94.116.246:80

From the client PC located on the Guest VPN, if you try to open facebook, instagram and youtube are blocked.

From client PC on Guest VPN, try to open facebook.com its blocked.

Site300-cE1#show utd engine standard logging events | in face
2024/07/24-13:05:25.622746 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.facebook.com] [VRF: 12] {TCP} 10.32.1.10:55872 -> 157.240.22.35:443
2024/07/24-13:05:25.638612 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.facebook.com] [VRF: 12] {TCP} 10.32.1.10:55876 -> 157.240.22.35:443

From client PC on Guest VPN, try to open instagram.com its blocked.

Site300-cE1#show utd engine standard logging events | in insta
2024/07/24-13:09:07.027559 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.instagram.com] [VRF: 12] {TCP} 10.32.1.10:58496 -> 157.240.22.174:443
2024/07/24-13:09:07.030067 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.instagram.com] [VRF: 12] {TCP} 10.32.1.10:58498 -> 157.240.22.174:443
2024/07/24-13:09:07.037384 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.instagram.com] [VRF: 12] {TCP} 10.32.1.10:58500 -> 157.240.22.174:443

From client PC on Guest VPN, try to open youtube.com its blocked.

Site300-cE1#show utd engine standard logging events | in youtube
2024/07/24-13:10:01.712501 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.youtube.com] [VRF: 12] {TCP} 10.32.1.10:54292 -> 142.250.72.206:443
2024/07/24-13:10:01.790521 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.youtube.com] [VRF: 10] {TCP} 10.30.1.10:37988 -> 142.250.72.206:443
2024/07/24-13:11:11.400417 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.youtube.com] [VRF: 12] {TCP} 10.32.1.10:54352 -> 142.250.72.206:443

Monitor URL Filtering From vManage GUI

You can monitor URL Filtering in real-time or historically for each device by web categories using these steps.

To monitor the URLs that are blocked or allowed on anCisco IOS XE Catalyst SD-WAN device:

From theCisco SD-WAN Managermenu, chooseMonitor > Devices > Select Device

Monitor URL Filtering from vManage GUI.

2. In the left pane, under Security Monitoring, clickURL Filtering. The URL Filtering information displays in the right pane.

Click Blocked. The session count on a blocked URL appears.
Click Allowed. The session count on allowed URLs appears.

Click URL Filtering, click on Blocked to check Session count.

Click URL Filtering, click on Allowed to check Session count.

Troubleshoot

Verify if the supported UTD version is installed:

Site300-cE1#show utd engine standard version
UTD Virtual-service Name: utd
IOS-XE Recommended UTD Version: 1.0.2_SV3.1.67.0_XE17.14
IOS-XE Supported UTD Regex: ^1\.0\.([0-9]+)_SV(.*)_XE17.14$
UTD Installed Version: 1.0.2_SV3.1.67.0_XE17.14   <<<<<<<<<<<<<<<<

Note: UTD Installed version cannot be on UNSUPPORTED state.

Check if UTD is onrunning state.

Site300-cE1#show app-hosting list
App id                                   State
---------------------------------------------------------
utd                                      RUNNING

Validate UTD heath status is in GREEN.

Site300-cE1#show utd engine standard status
Engine version       : 1.0.2_SV3.1.67.0_XE17.14
Profile              : Cloud-Low
System memory        :
              Usage  : 11.70 %
              Status : Green
Number of engines    : 1

Engine        Running    Health     Reason
=======================================================
Engine(#1):   Yes        Green      None
=======================================================
Overall system status: Green
Signature update status:
=========================
Current signature package version: 29.0.c
Last update status: None
Last successful update time: None
Last failed update time: None
Last failed update reason: None
Next update scheduled at: None
Current status: Idle

Verify the URL Filtering feature is enabled.


Site300-cE1#show platform hardware qfp active feature utd config
Global configuration
  NAT64: disabled
  Drop pkts: disabled
  Multi-tenancy: enabled
  Data plane initialized: yes
  TLS Decryption Policy: disabled
  Divert controller mode: enabled
  Unified Policy mode: disabled
  SN threads: 12

  CFT inst_id 0 feat id 4 fo id 4 chunk id 19

  Max flows: 165000
  SN Health: channel: Threat Defense : Green
  SN Health: channel: Service : Down

  Flow-logging Information:
  ------------------------
   State                  : disabled



  Context Id: 3, Name: 3 : 12

   Ctx Flags: (0xc50001)
        Engine: Standard
        State            : Enabled
        SN Redirect Mode : Fail-open, Divert
        Threat-inspection: Not Enabled
        Domain Filtering : Not Enabled
        URL Filtering    : Enabled
        File Inspection  : Not Enabled
        All Interfaces   : Enabled

To display the URL Filtering logs run show utd engine standard logging events url-filtering command.

Site300-cE1#show utd engine standard logging events url-filtering
2024/07/24-20:36:58.833237 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter blocklist [**] [URL: www.youtube.com] [VRF: 12] {TCP} x.x.x.x:57214 -> x.x.x.x:443
2024/07/24-20:37:59.000400 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter Category/Reputation [**] [URL: www.linkedin.com] ** [Category: Social Network] ** [Reputation: 81] [VRF: 12] {TCP} x.x.x.x:38058 -> x.x.x.x:443
2024/07/24-20:37:59.030787 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter Category/Reputation [**] [URL: www.twitter.com/] ** [Category: Social Network] ** [Reputation: 92] [VRF: 12] {TCP} x.x.x.x:41642 -> x.x.x.x:80
2024/07/24-20:38:59.311304 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter Category/Reputation [**] [URL: www.linkedin.com] ** [Category: Social Network] ** [Reputation: 81] [VRF: 12] {TCP} x.x.x.x:38068 -> x.x.x.x:443
2024/07/24-20:38:59.343273 PDT [**] [Hostname: site300-ce1] [**] [System_IP: x.x.x.x] [**] [Instance_ID: 1] [**] Drop [**] UTD WebFilter Category/Reputation [**] [URL: www.twitter.com/] ** [Category: Social Network] ** [Reputation: 92] [VRF: 12] {TCP} x.x.x.x:41652 -> x.x.x.x:80

Note: Run the command clear utd engine standard logging events to clear old events.

Check ingress/egress packets into UTD container, delay on lookup.

Site300-cE1#show utd engine standard statistics url-filtering vrf name 12 internal

UTM Preprocessor URLF Statistics
--------------------------------
URL Filter Requests Sent:                    50
URL Filter Response Received:                50
blocklist Hit Count:                         27
Allowlist Hit Count:                         0
Reputation Lookup Count:                     50
Reputation Action Block:                     0
Reputation Action Pass:                      50
Reputation Action Default Pass:              0
Reputation Action Default Block:             0
Reputation Score None:                       0
Reputation Score Out of Range:               0
Category Lookup Count:                       50
Category Action Block:                       15
Category Action Pass:                        35
Category Action Default Pass:                0
Category Action Default Block:               0
Category None:                               0
Category Out of Range:                       0

UTM Preprocessor URLF Internal Statistics
-----------------------------------------
Total Packets Received:                      1335
SSL Packet Count:                            56
HTTP Header Count:                           22
Action Drop Flow:                            69
Action Reset Session:                        0
Action Block:                                42
Action Pass:                                 503
Action Offload Session:                      0
Invalid Action:                              0
No UTM Tenant Persona:                       0
No UTM Tenant Config:                        0
URL Lookup Response Late:                    150
URL Lookup Response Very Late:               21
URL Lookup Response Extremely Late:          0
URL Lookup Response Status Invalid:          0
Response Does Not Match Session:             0
No Response When Freeing Session:            0
First Packet Not From Initiator:             0
No HTTP Header:                              0
Invalid Action:                              0
Send Error Fail Open Count:                  0
Send Error Fail Close Count:                 0
Lookup Error Fail Open Count:                0
Lookup Error Fail Close Count:               0
Lookup Timeout Fail Open Count:              0
Lookup Timeout Fail Close Count:             0

Related Information

Revision History

Revision	Publish Date	Comments
1.0	07-Aug-2024	Initial Release

Contributed by Cisco Engineers

Andy Rook
Customer Delivery Engineering Technical Leader
Karthik Reddy Yasa
Technical Consulting Engineer

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

Configure and Verify URL Filtering

Available Languages

Download Options

Bias-Free Language

Contents

Introduction

Prerequisites

Requirements

Components Used

Configure

Network Diagram

Configure Components for URL-Filtering Policy

Create URL Lists of Interest

Create Security Policy

Apply a Security Policy to a Device

Modify URL Flitering

Delete URL Filtering

Verify

Monitor URL Filtering From vManage GUI

Troubleshoot

Related Information

Revision History

Contributed by Cisco Engineers

Was this Document Helpful?

Contact Cisco

This Document Applies to These Products