URL objects

Updated: July 14, 2026

Want to summarize with AI?

An overview of url objects including DNS, HTTP, SSH, NTP, logging, sysopt, and device association settings.

URL objects and URL groups are used by Firepower devices. Use URL objects and groups (collectively referred to as URL objects) to define the URL or IP addresses of web requests. You can use these objects to implement manual URL filtering in access control policies or blocking in Security Intelligence policies. A URL object defines a single URL or IP address, whereas a URL group defines more than one URL or IP address.

When creating URL objects, keep the following points in mind:

If you do not include a path, meaning the URL has no / character, Security Cloud Control matches by the server host name only. The host name matches if it appears after the :// separator or after any dot in the host name. For example, ign.com matches ign.com and www.ign.com, but not verisign.com.
If you include one or more `/` characters, Security Cloud Control uses the entire URL string for substring matching, including the server name, path, and query parameters.
Do not use manual URL filtering to block or allow individual web pages or parts of sites unless you accept the risk of unexpected matches. Server paths can change, and substring matching can match unintended servers, paths, or query parameter strings.
Security Cloud Control disregards the encryption protocol. If you block a website, HTTP and HTTPS traffic to that website is blocked unless you use an application condition to target a specific protocol.
Do not include the protocol when you create a URL object. For example, use example.com, not http://example.com.
If you use a URL object to match HTTPS traffic in an access control rule, create the object with the subject common name in the public key certificate used to encrypt the traffic. Do not include subdomain information. For example, use example.com, not www.example.com.
The subject common name in a certificate might not match the website domain name. For more consistent HTTPS URL filtering, use SSL Decryption policy so that URL filtering rules evaluate decrypted traffic.

Note

URL objects do not match HTTPS traffic if the browser resumes a TLS session, because certificate information is no longer available. HTTPS connection matching can therefore be inconsistent.

Create or Edit an FDM-Managed URL Object

URL objects are reusable components that specify a URL or IP address.

To create a URL object, follow these steps:

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Click > FTD > URL.
	4.	Enter an object name and description.
	5.	Select Create a URL object.
	6.	Enter the specific URL or IP address for your object.
	7.	Click Add.

Create a Firepower URL Group

A URL group can be made up of one or more URL objects representing one or more URLs or IP addresses. The Firepower Device Manager and Firepower Management Center also refer to these objects as "URL Objects."

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Click > FTD > URL.
	4.	Enter an object name and description.
	5.	Select Create a URL group.
	6.	Add an existing object by clicking Add Object, selecting an object, and clicking Select. Repeat this step to add more objects.
	7.	Click Add when you are done adding URL objects to the URL group.

Edit a Firepower URL Object or URL Group

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Filter the objects to find the object you want to edit and then select the object in the object table.
	4.	In the details pane, click to edit.
	5.	Edit the values in the dialog box in the same fashion that you created them in the procedures above.
	6.	Click Save.
	7.	Security Cloud Control displays the policies that will be affected by the change. Click Confirm to finalize the change to the object and any policy affected by it.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.