Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got a Cisco ASA5510 with Firmware Version 8.0(5).
I'd like to restrict the source IPs that are allowed to access the Router through WebVPN (port 443). Here is the relevant part of the config.

access-list outside_access_in extended permit ip host any
access-list outside_access_in extended deny ip any any
access-group outside_access_in in interface outside
 enable outside
 svc image disk0:/anyconnect-win-2.3.0254-k9.pkg 1
 svc enable
 tunnel-group-list enable

Still, my webvpn port is available from all over the world. How can I fix this?

share|improve this question

migrated from Oct 23 '12 at 11:45

This question came from our site for professional and enthusiast programmers.

3 Answers 3

first define the extended ACL that permits specific source-adresses for VPN/WEBVPN, I have used the name internet

ciscoasa(config)# access-list internet extended permit tcp host any
ciscoasa(config)# access-list internet extended deny ip any any

then bind the extended ACL with the access-group command and the option control-plane together

ciscoasa(config)# access-group internet in interface outside control-plane

this should work with your version 8.x (ASA command reference lists this option in 8.x)

share|improve this answer
up vote 0 down vote accepted

In the meantime I've found out that there is no exact solution for this problem :(

According to Cisco Support Forums, there is no way to block webvpn using access lists.

Possible solutions to the problem are:

  • Place another router (Netgear, Cisco 800, ...) with firewall in front of the ASA
  • Try (legacy) IPsec VPN client
  • In my case, a Site-to-Site VPN would also be possible
share|improve this answer

You can apply a management access rule to the control plan of the asa and effectively permit/deny specific source addresses from accessing the webvpn address. Please reference the following:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.