Cisco FTD&FMC: restrict access for some external IP addresses to RA VPN

[mofnoc]

Hello!

How can I restrict access for some external IP addresses or may be gelocation to RA VPN address on FTD?

I have FTD controlled by FMC version 6.6.1. Prefilter and access control policy didn't affected.

Thanks.

[Rob Ingram · Accepted solution]

@mofnoc 

Pre-filter and ACP control traffic "through" the FTD, not for connections "to" the FTD, such as RAVPN.

So you cannot use Geolocation to control access to the FTD. You'd have to purchase another FTD and in place in front of your RAVPN FTD's, then the traffic would be going through the FTD and you can then use an ACP with geolocation.

Alternatively you could filter by IP address either on the upstream router or use flexconfig to apply a control plane ACL.

[rschlayer · Accepted solution]

Starting with Firepower (and FMC) 7.0 you could use Dynamic Access Policies to block known IP addresses from trying to VPN to your network. GEO blocking is sadly not possible.
See this enhancement here: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs65322/

[Jack G]

Are you sure it requires 7.0? Unless something changed, looks like it's just an ACL and Flexconfig per your link..?