topic Re: How to disable remote access traffic? in Network Security

How to disable remote access traffic?

majid3612 — Fri, 23 Oct 2020 17:30:59 GMT

I am going to disable remote access traffic across my network except my whitelist. I am using Cisco Firepower as well as Cisco ASA in my network perimeter. How and where should I put my rule/policy to enable this capability?

Re: How to disable remote access traffic?

balaji.bandi — Fri, 23 Oct 2020 17:55:21 GMT

Can you elaborate more with an example and post what configuration you have, and give some external IP you like to block and allow.

Re: How to disable remote access traffic?

majid3612 — Fri, 23 Oct 2020 21:05:42 GMT

For example, I want to permit remote traffic by RDP and Teamviewer but not other tools (Anydesk, VNC, etc.). Also, any backdoor which establish a remote connection between internal and external networks.

As mentioned, we have deployed ASA, Firepower, Umbrella and Meraki.

Re: How to disable remote access traffic?

Marvin Rhoads — Sun, 25 Oct 2020 04:12:56 GMT

You should use the policy in the Firepower service module to block the applications via an application level policy. Two rules will be needed:

1. First allow RDP and TeamViewer

2. Second block all other applications in the "Remote Desktop Control" category.

It should look something like this:

Example Policy

Re: How to disable remote access traffic?

majid3612 — Mon, 26 Oct 2020 16:20:03 GMT

Thanks Marvin for your great solution. I did so but it does not take effect! Users can still use Anydesk, for example. I saved the rules as well.

Re: How to disable remote access traffic?

Marvin Rhoads — Mon, 26 Oct 2020 17:30:24 GMT

It could be that those apps are using SSL and if FTD isn't decrypting it might not recognize the inner contents of the encrypted session as the app. In that case you might need to fall back on something like URL filter (if you have that licensed) or DNS security (e.g. via Umbrella) to prevent the clients from ever even resolving the address of the service to connect.

Re: How to disable remote access traffic?

Aref Alsouqi — Mon, 26 Oct 2020 17:58:51 GMT

Also, please note that the block might not happen straightaway, the Firepower might allow some packets to pass through before it can learn the application and apply the policy accordingly.

Re: How to disable remote access traffic?

majid3612 — Tue, 27 Oct 2020 16:59:26 GMT

Could you please be more specific about how to do so through URL filtering as well as DNS Security (Umbrella)? I looked at the both but not sure if that's exactly what I want. For example, you can block specific apps or URLs whereas I want to block a category of apps (remote access tools) which is not in their list.