https://community.cisco.com/t5/network-security/restrict-access-to-https-anyconnect-based-on-ip/m-p/3956898#M5056 <P>Hi,</P> <P>A normal ACL will filter traffic through the ASA but not traffic destined to the ASA's interface. You would need to use the "control-plane" syntax when defining the access-group. Example <A href="http://resources.intenseschool.com/to-the-box-traffic-filtering-on-cisco-asa/" target="_self">here</A>.</P> <P>&nbsp;</P> <P>HTH</P> Tue, 12 Nov 2019 00:21:17 GMT Rob Ingram 2019-11-12T00:21:17Z https://community.cisco.com/t5/network-security/restrict-access-to-https-anyconnect-based-on-ip/m-p/3956862#M5054 Im trying to restrict access through my ASA from several countries. When I test the ACL using my IP I lose ping ability and access to resources as I should. However I can still ping the outside interface and initiate an anyconnect connection. access-list outside extended deny ip object-group BlockedCountries any &lt;- blocks access to permitted resources but doesnt stop access to the outside interface itself webvpn enable outside anyconnect-essentials anyconnect image disk0:/anyconnect-win-4.7.00136-webdeploy-k9.pkg 1 anyconnect image disk0:/anyconnect-macos-4.7.00136-webdeploy-k9.pkg 2 anyconnect image disk0:/anyconnect-linux64-4.6.03049-webdeploy-k9.pkg 3 anyconnect profiles CPH_profile disk0:/cph_profile.xml anyconnect profiles MsiteVPN disk0:/msitevpn.xml anyconnect profiles Vendors disk0:/vendors.xml anyconnect enable tunnel-group-list enable cache disable is there anyway to evaluate traffic going to this interface itself? Fri, 21 Feb 2020 17:41:19 GMT https://community.cisco.com/t5/network-security/restrict-access-to-https-anyconnect-based-on-ip/m-p/3956862#M5054 Scott Whitney 2020-02-21T17:41:19Z https://community.cisco.com/t5/network-security/restrict-access-to-https-anyconnect-based-on-ip/m-p/3956865#M5055 Sorry it collapsed my format. let me know if there are any questions Mon, 11 Nov 2019 22:00:32 GMT https://community.cisco.com/t5/network-security/restrict-access-to-https-anyconnect-based-on-ip/m-p/3956865#M5055 Scott Whitney 2019-11-11T22:00:32Z https://community.cisco.com/t5/network-security/restrict-access-to-https-anyconnect-based-on-ip/m-p/3956898#M5056 <P>Hi,</P> <P>A normal ACL will filter traffic through the ASA but not traffic destined to the ASA's interface. You would need to use the "control-plane" syntax when defining the access-group. Example <A href="http://resources.intenseschool.com/to-the-box-traffic-filtering-on-cisco-asa/" target="_self">here</A>.</P> <P>&nbsp;</P> <P>HTH</P> Tue, 12 Nov 2019 00:21:17 GMT https://community.cisco.com/t5/network-security/restrict-access-to-https-anyconnect-based-on-ip/m-p/3956898#M5056 Rob Ingram 2019-11-12T00:21:17Z