topic Possible to use geo location to block access to remote access VPN? in Network Security

Possible to use geo location to block access to remote access VPN?

Jack G — Fri, 06 Mar 2020 16:57:39 GMT

I tried to create a ACL which was configured as source zone and destination zone both outside with a source IP as my public IP action deny, but once applied, I can still access the VPN signin page. Is there a way to block access to remote VPN from specific IPs?

Thank you!

Re: Possible to use geo location to block access to remote access VPN?

balaji.bandi — Fri, 06 Mar 2020 17:04:22 GMT

if this firepower Geo based ACL possible, if this ASA ( i am afraid as far as i concernt it available on ASA code)

Re: Possible to use geo location to block access to remote access VPN?

Jack G — Fri, 06 Mar 2020 17:09:34 GMT

Yes, it's a FTD firewall managed by FMC running the latest 6.5 code. I'm trying to research and perhaps it needs to be a control panel access control instead of the typical ACL rule? Not sure how or if a control panel ACL can be configured with FMC/FTD?

Re: Possible to use geo location to block access to remote access VPN?

Cristian Matei — Fri, 06 Mar 2020 17:22:33 GMT

Hi,

Use flexconfig to deploy a control-plane AC; if it doesn't work, open a TAC case and mention this bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn78593/?rfs=iqvred

Regards,

Cristian Matei.

Re: Possible to use geo location to block access to remote access VPN?

balaji.bandi — Fri, 06 Mar 2020 17:33:47 GMT

here is the guide for Geo location based rules for reference :

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-access.html

https://docs.defenseorchestrator.com/Configuration_Guides/Objects/Create_and_Edit_a_Firepower_Geolocation_Filter_Object

https://networkdirection.net/articles/firewalls/firepowermanagementcentre/fmcaccesscontrolpolicies/

Re: Possible to use geo location to block access to remote access VPN?

Jack G — Fri, 06 Mar 2020 17:36:33 GMT

I'm using geo ACL rules else where and it works fine. I just can't restrict access to VPN landing page which is hosted from the firewall outside interface.

Re: Possible to use geo location to block access to remote access VPN?

balaji.bandi — Fri, 06 Mar 2020 17:40:18 GMT

Try @Cristian Matei suggested flexconfig, if that is feasible for you.

Re: Possible to use geo location to block access to remote access VPN?

kostasthedelegate — Wed, 18 Nov 2020 09:43:18 GMT

Hello,

Could you give us some hint how the flexconfig configuration should be?

Regards,

Konstantinos