topic Re: You're welcome. in Network Security

cisco asa geo blocking.

nilesh.dubey — Fri, 21 Feb 2020 13:43:26 GMT

Is there a way by which we can block all the connections from a country on Cisco ASA, without we manually defining a ACL.

Hardware- Cisco ASA5510-

Version - 9.0

No.

Marvin Rhoads — Wed, 03 Feb 2016 15:31:30 GMT

No.

This sort of functionality is offered in the newer models (ASA 5500-X series) when you add the FirePOWER service modules with their associated license(s).

They can download and auto update a Geolocation database which you can use in your access policy.

Hi Marvin,

nilesh.dubey — Thu, 04 Feb 2016 10:36:41 GMT

Hi Marvin,

Thanks!!,

So do i need to purchase license as well along with firewall ?

I believe if all you want to

Marvin Rhoads — Thu, 04 Feb 2016 14:42:04 GMT

I believe if all you want to do is create a policy to allow or block certain countries, you can use the free Control license.

However, if you're going to the effort to configure and use the FirePOWER module NGIPS, it makes sense to buy at least the IPS license.

Available licenses are IPS (Protect), URL Filtering and Malware (Advanced Malware Protection or AMP).

Hi Marvin,

nilesh.dubey — Fri, 05 Feb 2016 15:34:58 GMT

Hi Marvin,

Thanks for your response.

Regards,

Nilesh

You're welcome.

Marvin Rhoads — Fri, 05 Feb 2016 15:36:29 GMT

You're welcome.

Please mark your question as answered if it has been.

Re: You're welcome.

scorpio.besal — Mon, 02 Oct 2017 14:58:47 GMT

Is it possible to use firepower module to block , say China using geo location but allow certain IPs from that country.

Re: You're welcome.

pro_engineering — Fri, 24 Aug 2018 15:59:03 GMT

Have you got any response for this?

Re: No.

antonkolev — Wed, 05 Oct 2022 15:23:39 GMT

I dont think this ever worked

Re: No.

Marvin Rhoads — Wed, 05 Oct 2022 15:38:22 GMT

You can insert rule(s) with PERMIT action above the rule for geoblocking the entire country. The first match (for action other than monitor) from the top down stops the processing of the rest of rules in the access control policy.

Re: No.

jueller01 — Mon, 24 Oct 2022 08:59:26 GMT

Is there a way to restrict AnyConnect users from certain countries? I have ASA's on Firepower 1140's.

Regards, Justin

Re: cisco asa geo blocking.

kelvindam — Wed, 19 Feb 2025 09:08:34 GMT

Old post, but if anyone is still looking to do Geo Blocking on ASA, then check this out : https://software.conscia.com/why-and-how-to-implement-geo-location-blocking-on-cisco-asa/