Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a Cisco ASA5510 with Firmware Version 8.0(5).
I'd like to restrict the source IPs that are allowed to access the Router through WebVPN (port 443). Here is the relevant part of the config.

access-list outside_access_in extended permit ip host 59.59.59.140 any
access-list outside_access_in extended deny ip any any
[...]
access-group outside_access_in in interface outside
[...]
webvpn
 enable outside
 svc image disk0:/anyconnect-win-2.3.0254-k9.pkg 1
 svc enable
 tunnel-group-list enable

Still, my webvpn port is available from all over the world. How can I fix this?

share|improve this question

migrated from stackoverflow.com Oct 23 '12 at 11:45

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 0 down vote accepted

In the meantime I've found out that there is no exact solution for this problem :(

According to Cisco Support Forums, there is no way to block webvpn using access lists.

Possible solutions to the problem are:

  • Place another router (Netgear, Cisco 800, ...) with firewall in front of the ASA
  • Try (legacy) IPsec VPN client
  • In my case, a Site-to-Site VPN would also be possible
share|improve this answer

You can apply a management access rule to the control plan of the asa and effectively permit/deny specific source addresses from accessing the webvpn address. Please reference the following: http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/asdm63/configuration_guide/config/access_management.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.