How to Filter Web Content Using MX and Cisco Talos
Click 日本語 for Japanese
Overview
The MX Content Filtering feature classifies URLs based on web content and threat categories curated by Cisco Talos, one of the largest commercial threat intelligence teams in the world. Talos comprises world-class researchers, analysts, and engineers who provide threat intelligence for Cisco customers, products, and services to defend against known and emerging threats. To learn more, refer to Cisco Talos Intelligence.
When you enable Content Filtering, the MX inspects one of the following:
- The URL in an HTTP payload, or
- The Server Name Indication field of outbound TLS traffic.
The MX uses these records to query Cisco Talos Intelligence for matching categories. The MX then stores these results in a local cache — up to 100,000 records, for up to 20 minutes at a time — to reduce latency.
Because TLS protects the underlying HTTP payloads from external inspection, Content Filtering can classify and block only domains — not full URLs — when TLS/HTTPS is in use.
Learn more with these free online training courses on the Meraki Learning Hub:
How block pages behave
When the MX blocks HTTP traffic, it performs an HTTP redirect on client traffic and sends it to a block page.
If the target website uses HTTPS/SSL rather than HTTP, the browser displays an error page instead of the Meraki block page. Because HTTPS/SSL traffic is encrypted, the MX cannot decrypt and redirect it to the block page. The request times out and results in an error.
Content Filtering cannot inspect and block QUIC connections. The packet payload is protected, so the MX cannot analyze the attributes normally used to filter traffic at the application level. Content Filtering does not work for sites using the QUIC protocol. Block UDP ports 80 and 443 using the Layer 3 firewall to force the use of TCP.
If you operate a vMX in a public cloud environment, the Meraki block page is not supported. You will see a browser error regardless of whether the traffic is HTTP or HTTPS.
Prerequisite
- Firmware: version MX17 and newer*
- Mode: Routed
- Requires: Advanced security or Secure SD-WAN Plus license
Content Filtering is not recommended for MX devices configured in Passthrough/Concentrator mode.
The feature remains visible on the Meraki Dashboard for devices running earlier firmware, but it relies on an older, third-party classification system that no longer functions as of January 1, 2025. Because of maximum firmware restrictions, Content Filtering no longer functions on several End of Support platforms that cannot run MX17 or greater firmware.
Firewall allowlist requirements
MX Security Appliances query the Cisco Talos domain and IP addresses below for Content Filtering categorization. Allow the following upstream of the MX, along with TCP port 443:
Domain:
-
.talos.cisco.com
IPv4 Addresses:
- 146.112.62.0/24
- 146.112.63.0/24
- 146.112.255.0/24
- 146.112.59.0/24
IPv6 Addresses:
- 2a04:e4c7:ffff::/48
- 2a04:e4c7:fffe::/48
Step-by-step instructions
Open the Content Filtering page
To begin configuration, go to Security & SD-WAN > Content filtering.
Configure category blocking
In MX 17 and newer with Cisco Talos categories, the dashboard splits website content and threat categories into two fields. Select a field to open a dropdown of categories.
Blocking the Computers and Internet or the Computer Security categories may impact Cisco services — for example, device connectivity to the Meraki cloud or other services such as Cisco Umbrella.
Configure group policies
Configure Group Policies under Network-wide > Group Policy. Group Policies provide custom configuration options that let you append, override, or use the default network configuration:
- Append: adds categories in addition to the default network configuration.
- Override: replaces the default network configuration.
- Use Network Default: applies the default policy configured on the Content Filtering page (Security & SD-WAN > Content Filtering).
For more information, refer to the Group policies page.
Check content and threat categories
If you are unsure which categories a URL belongs to, type the URL in the Type in the URL field under the Check content and threat categories section. This queries Cisco Talos Intelligence for the correlating content and/or threat category, and the results appear to the right.
- If the resulting category is not currently blocked, select the + sign next to the category to add it to your configuration in the Category blocking section.
- If the resulting category is already blocked, select x to remove the category from being blocked.
Allow or block specific URLs
- To explicitly block a URL, enter the URL pattern in the Block list URL patterns field under the URL blocking section.
- If a blocked category is blocking access to an unintended URL, enter the URL pattern in the Allow list URL patterns field under the URL blocking section to allow it.
Use the catch-all wildcard (*) in URLs
The asterisk symbol has two primary uses in URLs for Content Filtering.
Standalone catch-all wildcard
The * (asterisk) symbol on its own line is an all-inclusive wildcard that represents all possible entries:
- On its own line in allow listed URL patterns, it allow lists ALL URL patterns.
- On its own line in blocked URL patterns, it blocks ALL URL patterns, except those explicitly allow listed.
In-URL asterisk character
The * symbol used as part of a URL, or inline with a URL, is a regular asterisk symbol. The MX interprets it as part of the URL, not as a wildcard. This is rarely useful, except in URLs that actually require asterisk symbols, such as https://web.archive.org/web/*/meraki.com.
Understand URL matching patterns
Whenever a device on the network accesses a web page, the MX checks the requested URL against the configured lists to determine whether to allow or block the request:
-
The MX evaluates the full URL. For example, http://www.foo.bar.com/qux/baz/lol?abc=123&true=false is compared in its entirety and blocked or allowed if it matches an entry in either list.
-
The MX reduces the URL to its domain and subsequent parameters, then evaluates it. It removes http://www. (protocol and leading "www") from the front of the URL.
-
The MX reduces the URL to only the domain and its directory structure. For example, foo.bar.com/qux/baz/lol?abc=123&true=false reduces to foo.bar.com/qux/baz/lol by removing ?abc=123&true=false.
-
The MX removes pieces of the directory structure one level at a time, starting from the last directory. For example, foo.bar.com/qux/baz reduces to foo.bar.com/qux, which reduces to foo.bar.com.
-
The MX removes subdomains from left to right, eventually reducing to the top-level domain (.COM). For example, foo.bar.com reduces to bar.com, and eventually to .com.
-
Finally, the MX checks for the single asterisk character, used as a catch-all wildcard, in both the Allow and Block lists.
If any step produces a match, the MX blocks or allow lists the request as appropriate. The allow list always takes precedence over the blocklist, so a request that matches both lists is allowed. If there is no match, the request is subject to the category filtering settings above.
Dispute a content category
If a URL is categorized unexpectedly, submit a category dispute through the Talos Reputation Support page. You can submit up to 100 URL entries at a time. A CCO ID is required. If you do not have one, create a free guest account through the support page for submitting disputes.
To submit a content category dispute:
-
Select Submit a Content Categorization Ticket under the Content Categorization Requests section.
-
Select Cisco Login. If you do not have a CCO ID, create one at this step.
-
Enter the URL for dispute submission. This example uses www.example.com. The submission widget should automatically populate the current content category. If it does not, select Get Category Data.
-
Select a suggested content category for the URL.
-
Select Meraki MX as the platform.
-
Enter any additional comments or details for the dispute.
-
Select Submit.
After submission, view your open tickets on the Talos My Tickets page.
Threat Category Dispute
For threat category disputes, please contact Meraki Support to file a submission on your behalf.
Verification
Confirm the block behavior in the Event Log
Blocked Content Filtering events display in the Event Log. Go to Network-wide > Event Log to view them.
