IPs that are blocked by policy, still able to make VPN attempts

[codewize]

FP1010 locally managed
I have a policy at the top of my list blocking certain IPs
However, I see in the logs that IPs on that list are still able to make remote access attempts via WebVPN and get rejected because the user doesn't exist.

Why are they even able to get that far?

[MHM Cisco World · Accepted solution]

The policy effect traffic pass through not traffic direct into ftd' what you want is acl control-plane that deny these IP.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221469-configure-control-plane-access-control-p.html

MHM

[codewize]

Oh, never mind, I see. Duh. Sorry.