Whitelist on CPLANE

[zgovernale]

Cisco ASA Software Version 9.18(3)55

SSP OS Version 2.12(0.519)

I've been working with a managed service partner to try Whitelisting as a way to combat brute-force attacks. I've added a whitelist of known IP addresses to allow access and deny any other access.

We also have a tunnel for communication to a partner network. The issue I'm running into is that we lose that communication once this ACL is enacted. It's not right away but within the following hour. Note: I've added the partner IP range into the whitelist, I also don't have a FTN to enable geolocation blocking. 

Is there a better place to put a whitelist so that it won't impact internal communications?

[MHM Cisco World]

What is VPN you use RA VPN of S2S

MHM

[zgovernale]

The whitelist is meant to cover the people trying to RA VPN. The S2S is our tunneled connection to our partner org.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html

MHM

[MHM Cisco World]

I send you PM check it

MHM

[Rob Ingram]

@zgovernale what did you configure in the control plane ACL? If connections drop after an hour it could be an existing connection that timeouts and thus was unintentionally blocked in the cplane ACL. Check the logs to compare with the cplane ACL

For RAVPN protection and your hardware supports it, upgrade and use threat protection. https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-asa/222315-configure-threat-detection-services-for.html

[zgovernale]

The control plane ACL has a blacklist of known bad IP addresses, then a whitelist with every IP I could find/trust. This included the list of our partner orgs servers and it would still stop working after an amount of time.

Looking into the RAVPN protection you listed, I was able to upgrade to 9.18(4). I see that it listed 9.18(4)40. I'm unsure of the difference. If it helps we are running an ASAv

[Rob Ingram · Accepted solution]

@zgovernale it depends on which exact version of 9.18 you are running, 9.18(4)40 (or higher) is an interim version, which would include this functionality, the initial version of 9.18(4) would not.

9.18(4) interim version download - https://software.cisco.com/download/home/286119613/type/280775065/release/9.18.4%20Interim