Control Plane ACL for WebVPN

support — Tue, 12 Mar 2019 01:25:29 GMT

Hi some time ago we restricted access to our webvpn portal via the following acl

access-list outside-control-plane remark Allow VPN Access From Office

access-list outside-control-plane extended permit object-group Net_Access object BCH_Man_Range any

access-list outside-control-plane remark Allow VPN Access From Secondary Office

access-list outside-control-plane extended permit object-group Net_Access object BCH_Office2 any

access-list outside-control-plane remark Default Blocker

access-list outside-control-plane extended deny ip any any

access-group outside-control-plane in interface OUTSIDE control-plane

and it worked fine

(the default blocker isn't needed based on what I've been reading but it didn't seem to matter)

but we recently upgraded the firmware on our ASA5510 from I think 8.2 all the way up to 9.1.1

and ever since then the ACL now seems to be ignored and access is no longer restricted to our IP ranges

its accessbile to any ip

could it have something to do with the fact the ip's specified are the new network objects, first used in 8.3?

object network BCH_Man_Range

subnet 62.232.86.80 255.255.255.240

description Created during name migration

topic Control Plane ACL for WebVPN in Network Security