cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
721
Views
5
Helpful
6
Replies

ASA 5500-X with FirePOWER modules GEO block control plane traffic VPN

ChadH63728
Beginner
Beginner

Is it possible to send ASA control-plane traffic to the SFR module so that we can create a GEO block rule for VPN connections?

1 Accepted Solution

Accepted Solutions

@ChadH63728 unfortunately no, the Geoprotection is for "through" traffic and cannot control control-plane traffic. You would need to use a traditional control-plane ACL.

View solution in original post

6 Replies 6

@ChadH63728 unfortunately no, the Geoprotection is for "through" traffic and cannot control control-plane traffic. You would need to use a traditional control-plane ACL.

Thanks for confirming. In this case, if I create an ACL with ~50,000 network objects relating to Country subnets, will this cause latency or other issues? 

50,000 net ? wow it huge number, you need to use VPN pool not each anyconnect IP in control ACL.

@ChadH63728 not sure what exact model you have, so not sure on the performance with the old ASA 5500-X hardware.

The current Cisco recommendation is to control inbound RAVPN connection requests by using Geolocation restrictions within 2FA solution (such as Cisco Duo). Alternatively you could purchase an FTD and place in front of the RAVPN ASA, then you can use Geoprotection filtering on the FTD as this is "through" traffic, routed from outside/to inside where Geoprotection is supported. Neither are a particularly ideal solution though.

I created a post about this some time ago:

https://bluenetsec.com/ftd-geolocation/

Sadly, the FTD still doesn't seem to support blocking the geo traffic to itself.

Interesting info on how the GEO block database works on the back side. I'm using an ASA with SFR module which I think makes things even more complicated, but crazy that the FTD can't even GEOBlock traffic to itself. 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: