Block Traffic of MPLS on Cisco ASA

[Santimac]

Hello,

I have a CISCO ASA to get Internet, some VPNs, etc. and I have a MPLS to connect other Location, I want to Block certain traffic on this MPLS through the FW, but it seems that the ACLs that I created under ACL Manager are not working, the traffic is allwas allowed, please check my basic Diagram.

When I make a Packet Trace, I have the next result:

When I click on Show Rule, this is what I Got:

[balaji.bandi]

Your HLD diagram does not show that traffic always passing thorugh ASA, if the Link terminated to Switch. and device connected to same switch, they have no effect on your FW.

you need to give more information. are these device behind ASA inside ?

can you post the configuraiton, and tell us what is MPLS side IP address trying to connect Local Device RDP IP address which was getting access, even you mentioned it was blocked ?

[Santimac]

Thanks,
I forgot to post that I have a Cisco9K where all Default Gateways for my VLANs, and in this 9K is the Route for the MPLS, so as you said, I supposed the traffic from a Machine to the MPLS is not getting effect on the ASA correct?
Thanks

[balaji.bandi]

As i have mentioned earlier, if the ASA not in the path, there is no control you have with ASA.

[Santimac]

It is possible to connect the MPLS Router to an Interface of the ASA?

Thanks

[balaji.bandi · Accepted solution]

You can bring the MPLS network Outside of ASA, so Users from inside ASA can restrict as per your requirement.

allow only required people to access MPLS, and we are not sure how your MPLS network utilized what services for

if you move MPLS outside ASA, you need to have rules in place for those Service to reach MPLS network from your LAN or users