AnyConnect VPN with Geo-Filtering and Multiple ISPs

[ALI12]

Hi everyone,

We are currently using Cisco AnyConnect VPN, and recently, we've observed persistent brute-force attacks originating from various countries. To mitigate this, We decided to implement a geographical filter to limit access.

Here's the approach I took:

We have a secondary firewall from another vendor that supports geographical filtering.
I configured a connection between the two firewalls, mapping the public IP associated with ISP-1 on FW GeoFilter  to the ASA DMZ  interface. This setup is working well, and AnyConnect access is now restricted to specific countries.

Now, I would like to use another public IP, which is tied to ISP-2. However, the default route is set to ISP-1.

Is there a way to utilize the ISP-2 public IP for AnyConnect without changing the default route, which remains on ISP-1?

Thanks in advance for your insights!

[MHM Cisco World]

New Cisco ASA and FTD features block VPN brute-force password attacks

check this 

MHM

[ALI12]

@MHM Cisco World 
Thank you for your input.

While FTD is a great solution for geographical filtering in front of the firewall, it is currently unavailable within the company.
As a temporary measure, we utilizing the control plane to mitigate the brute-force attacks.

[MHM Cisco World]

As I know geo filtering is not work for traffic direct to FTD.

So check cisco doc. About this issue 

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html

MHM

[ALI12]

I'll review the document. Thank you @MHM Cisco World 

[Cristian Matei]

Hi,

    One solution would be to use two default routes, which I understand you want to avoid. The other solution is to use policy based routing for all your non-VPN traffic towards the Internet (so routing table will not be used for this traffic) and shift the default route to  ISP-2 which will allow your VPN connections to be established. Ensure that VPN traffic coming from inside the network and going through VPN tunnels is NOT subject to your PBR policy; otherwise, VPN connection gets established (control-plane) however data-plane will fail as incoming traffic as from ISP-2 but outgoing traffic ends uo being policy routed via ISP-1 and actually gets dropped.

Best,

Cristian.

[ALI12]

@Cristian Matei 
Thank you for your insights. I appreciate your suggestion regarding the use of two default routes with policy-based routing (PBR). As you mentioned, enabling the route-map or PBR is essential to implement this solution effectively.