cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
274
Views
1
Helpful
3
Replies

Need ASA control-plane ACL's. 2 outside interfaces to block bad actors

tryingtofixit
Level 1
Level 1

Need to setup control plane blocks for two OUTSIDE interfaces.

Only have production ASA's running 9.1.x so can't "try it out".

Will the below work, or is there an easier method?

BLCKCOUNTRY is an object group (not shown) with 200 subnets to block.

10.11.11.0&11.11.11.0 are my fake outside IPs (to be changed to real ips)

!outside01 ctrl plane block access-list

access-list ctrl-plane-block01 line 1 remark control-plane bad actor block for outside01

access-list ctrl-plane-block01 line 2 extended deny ip object-group BLCKCOUNTRY 11.11.11.0 255.255.255.0

!outside01 access-group applied to outside01 interface

access-group ctrl-plane-block01 in interface outside01 control-plane

! outside01=11.11.11.0/24

! outside02 ctrl plane block access-list

access-list ctrl-plane-block02 line 1 remark control-plane bad actor block for outside02

access-list ctrl-plane-block02 line 2 extended deny ip object-group BLCKCOUNTRY 10.11.11.0 255.255.255.0

!outside02=10.11.11.0/24

! access-group applied to outside02 control-plane

access-group ctrl-plane-block02 in interface outside02 control-plane

Thanks 

1 Accepted Solution

Accepted Solutions

The config is correct 

The control plane ACL 

1- dont effect ssh/telent to asa 

2- there is no implicit deny in end' this meaning the deny will check and if IP match the traffic will drop any IP not match deny line can pass   this need for other VPN IP (s2s and ra vpn)

MHM

View solution in original post

3 Replies 3

yes, this is the article I used to base my config from. having two outside interfaces complicates things, and I also have an object-group to use for blocking with ip ranges, not a new access-list doing this.  Thanks

The config is correct 

The control plane ACL 

1- dont effect ssh/telent to asa 

2- there is no implicit deny in end' this meaning the deny will check and if IP match the traffic will drop any IP not match deny line can pass   this need for other VPN IP (s2s and ra vpn)

MHM

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card