topic Re: Filtering access for vpn clients in Network Security

Filtering access for vpn clients

Ricky Sandhu — Tue, 12 Jul 2022 03:50:27 GMT

Good evening, from a firewall perspective, which interface does the ASA consider an Anyconnect VPN client coming in on? Here is the situation, I have allowed restricted access from INSIDE to our DMZ based on source and destination IP addresses. Only 6 machines on the INSIDE should be able to talk to the machine in DMZ. This part is working fine. However remote access VPN clients on the same ASA have full access to the DMZ machine for some reason. I need to block this but can't figure out where to create the rule. I have already confirmed the traffic coming in from OUTSIDE does not have a rule allowing it to talk to the DMZ machine in question. I also have a global deny all.

Please advise.

Thank you

Re: Filtering access for vpn clients

Marvin Rhoads — Tue, 12 Jul 2022 04:09:33 GMT

Most commonly AnyConnect and site-site VPNs are set to bypass interface ACLs with "sysopt connection permit-vpn" command. You may need to "show run all" to see this command as it is a hidden default.

There are at least two ways to restrict the AnyConnect clients even with that command enabled:

1. Only tunnel specified subnets to the clietn and exclude the DMZ subnet.

2. Add a vpn-filter for the client connections (e.g. good to use when you otherwise tunnel all traffic).

Re: Filtering access for vpn clients

MHM Cisco World — Tue, 12 Jul 2022 06:38:18 GMT

there are many ways,
first
VPN-filter "under group-policy"
https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html

second
no sysopt connection permit-vpn
then apply ACL in DMZ interface to deny traffic from VPN
and apply ACL in Inside interface to allow traffic from VPN