topic Re: Whitelist on CPLANE in Network Security

Whitelist on CPLANE

zgovernale — Mon, 16 Dec 2024 17:36:47 GMT

Cisco ASA Software Version 9.18(3)55

SSP OS Version 2.12(0.519)

I've been working with a managed service partner to try Whitelisting as a way to combat brute-force attacks. I've added a whitelist of known IP addresses to allow access and deny any other access.

We also have a tunnel for communication to a partner network. The issue I'm running into is that we lose that communication once this ACL is enacted. It's not right away but within the following hour. Note: I've added the partner IP range into the whitelist, I also don't have a FTN to enable geolocation blocking.

Is there a better place to put a whitelist so that it won't impact internal communications?

Re: Whitelist on CPLANE

MHM Cisco World — Mon, 16 Dec 2024 17:41:01 GMT

What is VPN you use RA VPN of S2S

MHM

Re: Whitelist on CPLANE

zgovernale — Mon, 16 Dec 2024 17:43:11 GMT

The whitelist is meant to cover the people trying to RA VPN. The S2S is our tunneled connection to our partner org.

Re: Whitelist on CPLANE

Rob Ingram — Mon, 16 Dec 2024 17:45:06 GMT

@zgovernale what did you configure in the control plane ACL? If connections drop after an hour it could be an existing connection that timeouts and thus was unintentionally blocked in the cplane ACL. Check the logs to compare with the cplane ACL

For RAVPN protection and your hardware supports it, upgrade and use threat protection. https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-asa/222315-configure-threat-detection-services-for.html

Re: Whitelist on CPLANE

MHM Cisco World — Mon, 16 Dec 2024 17:45:32 GMT

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html

MHM

Re: Whitelist on CPLANE

zgovernale — Tue, 17 Dec 2024 23:22:11 GMT

The control plane ACL has a blacklist of known bad IP addresses, then a whitelist with every IP I could find/trust. This included the list of our partner orgs servers and it would still stop working after an amount of time.

Looking into the RAVPN protection you listed, I was able to upgrade to 9.18(4). I see that it listed 9.18(4)40. I'm unsure of the difference. If it helps we are running an ASAv

Re: Whitelist on CPLANE

Rob Ingram — Wed, 18 Dec 2024 08:49:44 GMT

@zgovernale it depends on which exact version of 9.18 you are running, 9.18(4)40 (or higher) is an interim version, which would include this functionality, the initial version of 9.18(4) would not.

9.18(4) interim version download - https://software.cisco.com/download/home/286119613/type/280775065/release/9.18.4%20Interim

Re: Whitelist on CPLANE

MHM Cisco World — Wed, 18 Dec 2024 14:22:31 GMT

I send you PM check it

MHM