How to To-The-Box Traffic Filtering on Cisco ASA

[jewfcb001]

Hi All ,

I try to block and filter source ip for VPN tunnel (SSL/IPSEC) . I see some document recommend command "control-plan' in access-group command . But I try to use this  command but not working .

My LAB Topology for Test.

Client ---------------------outside[ASA]----------------

192.168.1.1    --------- 192.168.1.254 -------

access-list outside extended deny ip host 192.168.1.1 host 192.168.1.254

access-group outside in interface outside control-plane 

but still can ping from source ip 192.168.1.1 to 192.168.1.254 

I'm not sure this scenario correct for test ?

I test in asav version 9.12 

Please advise me .

[Rob Ingram]

@jewfcb001 that's probably because ICMP traffic is controlled separately on the ASA using the command "icmp permit|deny <ip_address< <net_mask> <icmp_type> <if_name>" and not controlled via interface control plane ACL. The same applies for SSH or HTTPS to manage the ASA itself.

Setup a VPN and attempt to establish connectivity to confirm the control-plane is or is not working correctly.

[jewfcb001 · Accepted solution]

@Rob Ingram 

Thank you for information . I try to setup VPN and filter client for  establish connectivity . it's working fine with the command 

access-group outside in interface outside control-plane  

          Test in Lab

• Configure ACL for Deny host to VPN

            Client Connect without ACL Client can establish to Firewall

After Apply Access group with command “control-plane”  Client cannot establish to Firewall

ACL Hit Count

I hope this topic for help everyone 

Thank you .