filter internet ip addres allow to initiate vpn connection

[Danilo Dy]

Hi,

Using Cisco ASA5510 Security Plus (Post May 2010) with 8.2(1)

I was trying to limit the number of internet IP Address that can initiate Remote Access VPN connection to the firewall. I have plan to only allow internet IP Address from few ISPs for control.

However, blocking AHP, ESP, ISAKMP, NON500-ISAKMP, and IPSec Over TCP Port Assigned in the firewall outside interface doesn't help. But it works by putting the ACL in the router before the firewall. It seems that the  firewall have a "hidden" process VPN first before user entered ACL (or explicit rule), similar to Checkpoint FW's implied rule. How to get around it?

TIA

[Jennifer Halim · Accepted solution]

Yes you are right. The firewall does not check what IP Address is initiating the VPN to it as with remote vpn client, they can connect from various different IP Addresses.

If you want to allow only certain IP Addresses to VPN to the firewall, as you have tested, you would need to do block it on the router in front of the firewall.

Hope that answers your question.

[kampmalm2]

Hi

What happened with the old PIX command "sysopt connection permit-ipsec" ?

If you remove that in the PIX, then it's poosible to control VPN-connections with a access-list.

Isn't there any equivalent command in the ASA?

Regards

[Jennifer Halim]

The "sysopt connection permit-ipsec" will not allow the encrypted traffic, it will only allow the traffic after it is being decrypted (ie: the clear text traffic after decryption). What Danilo wants to do is the actual VPN session (encrypted traffic) to be restricted from specific IP Addresses only.

[Danilo Dy]

Thanks Jennifer.

Your reply confirms my initial investigation. I thought I was missing something, took me a lot of time to try to find a way to get around it

I'm trying to push the security envelop further for Remote Access due to the reason that there is no universal cyber law or it doesn't cross border (states/country).