0

I've got a Cisco ASA5510 with Firmware Version 8.0(5).
I'd like to restrict the source IPs that are allowed to access the Router through WebVPN (port 443). Here is the relevant part of the config. 

access-list outside_access_in extended permit ip host 59.59.59.140 any
access-list outside_access_in extended deny ip any any
[...]
access-group outside_access_in in interface outside
[...]
webvpn
 enable outside
 svc image disk0:/anyconnect-win-2.3.0254-k9.pkg 1
 svc enable
 tunnel-group-list enable

Still, my webvpn port is available from all over the world. How can I fix this?

Improve this question

3 Answers 3

Reset to default
2

first define the extended ACL that permits specific source-adresses for VPN/WEBVPN, I have used the name internet 

ciscoasa(config)# access-list internet extended permit tcp host 59.59.59.140 any
ciscoasa(config)# access-list internet extended deny ip any any

then bind the extended ACL with the access-group command and the option control-plane together

ciscoasa(config)# access-group internet in interface outside control-plane

this should work with your version 8.x (ASA command reference lists this option in 8.x)

Improve this answer
1
  • This is the correct answer. It works, I have personally verified it. Note that if you apply this restriction, it will also apply to IPSec coming in, so you might want to permit udp/500, udp/4500, eh and esp.
    – Konrads
    Feb 6, 2018 at 9:58
0

You can apply a management access rule to the control plan of the asa and effectively permit/deny specific source addresses from accessing the webvpn address. Please reference the following: http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/asdm63/configuration_guide/config/access_management.html

Improve this answer
-1

In the meantime I've found out that there is no exact solution for this problem :(

According to Cisco Support Forums, there is no way to block webvpn using access lists.

Possible solutions to the problem are:

  • Place another router (Netgear, Cisco 800, ...) with firewall in front of the ASA
  • Try (legacy) IPsec VPN client
  • In my case, a Site-to-Site VPN would also be possible
Improve this answer
1
  • This answer is factually incorrect, tekcert.com and @Roli's answers are correct.
    – Konrads
    Feb 6, 2018 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .