AnyConnect Block remote IP Address on FMC

[Ralf Wieseke]

Hello Community,

Is it possible to block or blacklist an IP address for using client VPN on an FTD using FMC?

I can see the connections via packet tracer but i did not see them in the connection events.

I tried to configure a prefilter rule and a global blacklist for that IP with no effect.

Any ideas?

[balaji.bandi]

Just thogutht why not create an access policy outside interface to block those IP address (which is known) connect to outside IP address.

[Rob Ingram · Accepted solution]

@Ralf Wieseke 

A pre-filter or ACP rule is for traffic "through" the FTD, not "to" the FTD for VPNs. You'll need to use a control plane ACL inbound on the outside interface, this can currently only be done using Flexconfig.

Here is an example:-

https://community.cisco.com/t5/network-security/block-access-to-remote-access-vpn-by-ip-address/td-p/4406832

[Ralf Wieseke]

Hi Rob,

This is exactly what i have been looking for.

Thank you.