I've gotten a chance to build a lab in EVE-NG to test out control-plane blocking and make sort of a "poor mans geoblocking". End result is I want to block IP's from Russia, China, etc, that have no business trying to hit my SSLVPN. Currently, I Shun any IP's that attempt it but you can only do a specific IP with Shun, you can't do any subnets. I've seen a lot about the Control-Plane access list but I'm a bit hesitant to do so as I don't want to accidently block my own access to the ASA. After getting Eve-NG up and running a lab for me, I'm able to play with this setup without fear of breaking anything in production. However, the lab isn't a one-for-one. I'm only able to run an ASAv in the lab. Can't seem to emulate a regular ASA like mine, so I'm not 100% sure of the differences between what I'm going to see in the lab and what I'm going to see in production.
So here is the situation.
I've created an control-plane access list called "BlackList". My lab currently has 3 "sites". Site 2 is setup to connect with a VPN to Site 1 (site 1 is where the ASA sits) and the VPN connects without issue. This is to simulate our VPN connections to other places and make sure my control-plane list doesn't bork any of them. Site 3 is set up with a VPN connection to site 1, but site 1 has no corresponding configuration. This is to simulate the random IPSec tunnels that try to connect. I've put the subnet of site 3 into the BlackList group.
What I expect to happen: Site 3 is always trying to establish a IPSec VPN. I add site 3 to the BlackList and rather than seeing incoming IPSec vpn tunnels trying to establish, I'll see Denys in the log shortly after I hit "apply".
What actually happens: I continue to see site 3 coming in as attempted IPSec VPN connections.
Now, I know my rules work. If I stop Site 3 from trying to establish the IPSec VPN for a few minutes, long enough to see the log tell me it's tearing down the UDP connection, then turn the VPN from site 3 back on, with no changes to the ASA at Site 1, I see Denys in the log and not the attempted IPSec VPN connection. So the rule works but only after that UDP session is cleared. Is this "normal" or is it just because it's in a lab? Obviously in a live environment, I can't stop the incoming IPSec VPN session long enough for the ASA to teardown the session so it re-evaluates rules.
