Block IP's from accessing clientless VPN

[jf1134]

We have a web URL setup so that our users can go to the site and download the AnyConnect client.

In the last week, we are getting tons of failed login attempts that I believe are coming from people trying to login. The are some common IPs and I have setup an ACL that deny's IP to any but they are still coming through. I also tried configuring the NSG in Azure to deny any traffic from those IP's but that doesn't work. Our ASA is a ASAv in Azure

Is there anyway to block specific IP's from being allowed to even load that site? I even tried to put it behind our Cloudflare WAF and setup a rule to deny the IP's and that didn't work either. 

[Rob Ingram]

@jf1134 you could use a control-plane ACL or an ACL on the router in front of the ASA to block the traffic or use the "shun" command, although I don't believe that survives a reboot.

[Ruben Cocheno]

@jf1134 

You can always try some Geolocation if possible

[MHM Cisco World]

This second posts same issue 

And my reply is same 

Use shun or acl control plane 

Did you check my previous reply?

MHM