ASA 5500-X with FirePOWER modules GEO block control plane traffic VPN

[ChadH63728]

Is it possible to send ASA control-plane traffic to the SFR module so that we can create a GEO block rule for VPN connections?

[Rob Ingram · Accepted solution]

@ChadH63728 unfortunately no, the Geoprotection is for "through" traffic and cannot control control-plane traffic. You would need to use a traditional control-plane ACL.

[ChadH63728]

Thanks for confirming. In this case, if I create an ACL with ~50,000 network objects relating to Country subnets, will this cause latency or other issues? 

[MHM Cisco World]

50,000 net ? wow it huge number, you need to use VPN pool not each anyconnect IP in control ACL.

[Rob Ingram]

@ChadH63728 not sure what exact model you have, so not sure on the performance with the old ASA 5500-X hardware.

The current Cisco recommendation is to control inbound RAVPN connection requests by using Geolocation restrictions within 2FA solution (such as Cisco Duo). Alternatively you could purchase an FTD and place in front of the RAVPN ASA, then you can use Geoprotection filtering on the FTD as this is "through" traffic, routed from outside/to inside where Geoprotection is supported. Neither are a particularly ideal solution though.

[Aref Alsouqi]

I created a post about this some time ago:

https://bluenetsec.com/ftd-geolocation/

Sadly, the FTD still doesn't seem to support blocking the geo traffic to itself.

[ChadH63728]

Interesting info on how the GEO block database works on the back side. I'm using an ASA with SFR module which I think makes things even more complicated, but crazy that the FTD can't even GEOBlock traffic to itself.