Hi to everyone, I'm opening this thread because I have a question and your advice would really be helpful.
Is there a way to block access to the webvpn portal in Cisco FMC/FTD? We have recently been receiving login attempts with different users that do not belong to us and everything points to it being a brute force attack.
Tests performed:
1) Connection events. Nothing showed.
2) Logs in the console, but they are too many and not very readable.
3) Capture of traffic with packet capture and Unified events in real time. Too much tcp/udp sessions and its impossible to track correctly.
4) Block everything and allow only the public IPs of the workers. It is not possible because the ISPs change the public IPs every so often (even weeks)
I have been told in other forums that it is not possible to filter because if the webvpn platform is raised from the same interface of the Firewall with a public IP, it becomes control plane and not a data plane and these geolocation ACLs doesn´t filter that traffic.
Any help or advice is welcome.
Greetings,
