Cisco Cisco Firepower Management Center 4000

Optionally, click the add icon (

) above the 

 list to add an individual URL object.

You can specify a single URL in each individual URL object you add. You can then select objects you 
added as conditions for your rule. See 

 and 

 for more information.

Optionally, click the 

 prompt beneath the 

list, type a literal URL, then click 

.

The list updates to display your entry. See 

 for more information.

Note that you cannot specify a reputation level for a literal URL.

Save or continue editing the rule.

You must apply the access control policy for your changes to take effect; see 

.

Protection or Malware

feature dependent

feature dependent

In addition to handling traffic matching the conditions in an access control rule, you can perform further 
inspection on allowed traffic by associating the rule with an intrusion or file policy. 

When you make this association, you are telling the system that before it passes traffic that matches the 
access control rule’s conditions, you first want to inspect the traffic with an intrusion policy, a file policy, 
or both. Depending on your deployment and on policy configurations, both intrusion and file policies 
can prevent network traffic from reaching its intended destination. 

As shown in the diagram below, for traffic that matches an Allow or user-bypassed Interactive Block 
rule:

the system automatically performs discovery on the networks listed in the currently applied network 
discovery policy, 

an optional file policy performs file control and AMP, and

an optional intrusion policy performs detection and prevention.

Because file inspection occurs before any intrusion policy inspection, blocked files (including malware) 
are not inspected for intrusion-related exploits.

For more information on Allow and Interactive Block rules, and why only access control rules with those 
actions can trigger additional inspection, see 

. Also note that you 

can associate an intrusion policy, but not a file policy, with the access control default action.