topic Ok, in Network Security

Cisco Asa Firepower

mproenca2014 — Tue, 12 Mar 2019 09:16:41 GMT

Hi you all,

Where do I implement firewall rules in a Cisco Asa with Firepower?

Is it in Asa Module or Firepower Module?

Thanks

In the ASA.

Collin Clark — Wed, 26 Apr 2017 14:46:01 GMT

In the ASA.

Ok,

mproenca2014 — Wed, 26 Apr 2017 15:28:50 GMT

Ok,

So now i'm facing another issue.

I configured a remote vpn, cisco anyconnect, but the traffic goes trough my firewall rules, I mean, nothing is dropped, everything passes to my local interface.

What am I missing?

By default that is the

Collin Clark — Wed, 26 Apr 2017 15:46:58 GMT

By default that is the correct behavior. If you need to restrict access then you will have to create an ACL.

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html#anc6

That's correct.

mproenca2014 — Wed, 26 Apr 2017 15:55:45 GMT

That's correct.

And I created a rule for all interfaces denying everything.

Any to Any Deny.

access-list INSIDE_access_in extended deny ip any any

access-list ART_access_in_1 extended deny ip any any

access-list NOS_access_in extended deny ip any any

But still working. I cannot see what's missing.

My first comment is that you

Richard Burts — Wed, 26 Apr 2017 20:52:09 GMT

My first comment is that you show us access list configuration but do not show us how the access lists are applied and how they are applied is critical to whether they work or not.

But the really important comment is that for AnyConnect the normal behavior is that access lists on interfaces do not evaluate or control AnyConnect VPN traffic. The expected behavior is that anything that comes into the ASA via AnyConnect will be allowed to pass through the ASA. If you want to control VPN traffic you should look into using VPN filters.

HTH

Rick