topic Re: FMC Object Management / ACL in Network Security

FMC Object Management / ACL

GRANT3779 — Fri, 21 Feb 2020 15:56:04 GMT

Within the FMC where exactly do the ACLs under Object Management fit in with deploying configs to registered devices?

For FTD devices I was under the impressions Prefilter and ACP rules took over the role of the traditional ACL on an ASA?

Are the ACLs under Object Management meant for the devices running traditional ASA with FirePOWER services? If so, how exactly are they applied to the ASA Interfaces via FMC?

Re: FMC Object Management / ACL

yogdhanu — Fri, 29 Jun 2018 13:47:19 GMT

Where do you see the ACL in object management?

FMC deploys the policy same way on FTD as it does not firepower (from top overview)

Its all about access control policy with objects created which can be used in multiple policies.

There is no ACL in object management as far as I see. Can you give screenshot of what do you mean?

Thanks,

Yogesh

Re: FMC Object Management / ACL

GRANT3779 — Fri, 29 Jun 2018 13:54:32 GMT

Hi Yogesh,

See attached.

Re: FMC Object Management / ACL

Rahul Govindan — Fri, 29 Jun 2018 13:57:53 GMT

Split-tunneling and VPN Filters for Anyconnect are configured as ACL's on the Firepower, same as how they are on the ASA. This is where you would configure them. If you have configured them from the VPN section, they would show up here.

Re: FMC Object Management / ACL

Rahul Govindan — Fri, 29 Jun 2018 14:00:07 GMT

ACL objects are used for Route-maps as well.

Re: FMC Object Management / ACL

Scott Reedman — Tue, 09 Apr 2019 00:26:07 GMT

Hey Rahul,

Is using the standard and Extended ACL's really the only way to control anyconnect clients? I am using a couple of 2110's for VPN clients only as a recent SD-WAN implementation has freed them up and I would rather use these than older ASA5520's. I have one each at 2 sites and managing them with the FMC. The outside interface has a static external IP and the inside is attached to the core on a separate VLAN for the device. I am using separate address pools on the FTD boxes for different groups of contractor, employees from different departments ect. Is there anyway to apply all the features of ACP and prefilter to the VPN clients?