Need ASA control-plane ACL's. 2 outside interfaces to block bad actors

[tryingtofixit]

Need to setup control plane blocks for two OUTSIDE interfaces.

Only have production ASA's running 9.1.x so can't "try it out".

Will the below work, or is there an easier method?

BLCKCOUNTRY is an object group (not shown) with 200 subnets to block.

10.11.11.0&11.11.11.0 are my fake outside IPs (to be changed to real ips)

!outside01 ctrl plane block access-list

access-list ctrl-plane-block01 line 1 remark control-plane bad actor block for outside01

access-list ctrl-plane-block01 line 2 extended deny ip object-group BLCKCOUNTRY 11.11.11.0 255.255.255.0

!outside01 access-group applied to outside01 interface

access-group ctrl-plane-block01 in interface outside01 control-plane

! outside01=11.11.11.0/24

! outside02 ctrl plane block access-list

access-list ctrl-plane-block02 line 1 remark control-plane bad actor block for outside02

access-list ctrl-plane-block02 line 2 extended deny ip object-group BLCKCOUNTRY 10.11.11.0 255.255.255.0

!outside02=10.11.11.0/24

! access-group applied to outside02 control-plane

access-group ctrl-plane-block02 in interface outside02 control-plane

Thanks 

[balaji.bandi]

Configure a control-plane ACL for ASA using CLI

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221469-configure-control-plane-access-control-p.html#toc-hId--1694527793

[tryingtofixit]

yes, this is the article I used to base my config from. having two outside interfaces complicates things, and I also have an object-group to use for blocking with ip ranges, not a new access-list doing this.  Thanks

[MHM Cisco World · Accepted solution]

The config is correct 

The control plane ACL 

1- dont effect ssh/telent to asa 

2- there is no implicit deny in end' this meaning the deny will check and if IP match the traffic will drop any IP not match deny line can pass   this need for other VPN IP (s2s and ra vpn)

MHM