How to disable remote access traffic?

[majid3612]

I am going to disable remote access traffic across my network except my whitelist. I am using Cisco Firepower as well as Cisco ASA in my network perimeter. How and where should I put my rule/policy to enable this capability?

[balaji.bandi]

Can you elaborate more with an example and post what configuration you have, and give some external IP you like to block and allow.

[majid3612]

For example, I want to permit remote traffic by RDP and Teamviewer but not other tools (Anydesk, VNC, etc.). Also, any backdoor which establish a remote connection between internal and external networks.

As mentioned, we have deployed ASA, Firepower, Umbrella and Meraki.

[Marvin Rhoads]

You should use the policy in the Firepower service module to block the applications via an application level policy. Two rules will be needed:

1. First allow RDP and TeamViewer

2. Second block all other applications in the "Remote Desktop Control" category.

It should look something like this:

Example Policy

[majid3612]

Thanks Marvin for your great solution. I did so but it does not take effect! Users can still use Anydesk, for example. I saved the rules as well.

 

[Aref Alsouqi]

Also, please note that the block might not happen straightaway, the Firepower might allow some packets to pass through before it can learn the application and apply the policy accordingly.

[Marvin Rhoads]

It could be that those apps are using SSL and if FTD isn't decrypting it might not recognize the inner contents of the encrypted session as the app. In that case you might need to fall back on something like URL filter (if you have that licensed) or DNS security (e.g. via Umbrella) to prevent the clients from ever even resolving the address of the service to connect.

[majid3612]

Could you please be more specific about how to do so through URL filtering as well as DNS Security (Umbrella)? I looked at the both but not sure if that's exactly what I want. For example, you can block specific apps or URLs whereas I want to block a category of apps (remote access tools) which is not in their list.