Cisco ASA5508 VPN block attacking IPs

[Sheridan]

I'm a bit of a newb with Cisco ASA kit, and it appears ours it being attacked on the VPN access side

 

We have the ASA VPN set to Radius against a Windows NPS server, which then uses Azure MFA to authenticate. Works fine but we've noticed a handful of users accounts being locked out.

 

This is from the NPS server being hit with external attempts to authenticate with these accounts (some of the accounts aren't even around anymore)

 

Its only from a small number of external IPs, so is there as way I can get the ASA to drop anything at all from these IPs, as a firewall access rule is already in place - there must be a way to do this for VPN connection attempts?

[PaddyNewman]

Do you just have an access list entry. Last time I tried this, I had to add control-plane to the rule, stops it being passed to the ASA.

 

If you can't find out the syntax, I'll see if I can get onto my ASA.

[Sheridan]

Do you just have an access list entry. Last time I tried this, I had to add control-plane to the rule, stops it being passed to the ASA.

 

If you can't find out the syntax, I'll see if I can get onto my ASA.

 

I’m not sure as I’ve inherited this system and only really looked at the firewall rules which don’t apply to the vpn!

 

Any help would be really useful if you can dump the commands here?

[PaddyNewman]

Presumably you mean don't apply as they've already made it through the WAN. The access-list entries apply in the ASA level, but control-plane rules are pre WAN so should be stopped before hand.

 

Are you cli managing. I don't know any other method but having a nose I've got this...

 

access-list block-test extended deny tcp host 5.1.77.3 10.255.0.1 eq 443

access-group block-test in interface outside control-plane

 

My ASA is 10.255.0.1.

 

It's been a while since I tried or monitored a VPN on this device as ASA is ... Well I don't have software or hardware support or patches, it's a personal device.

 

Thankfully it still runs!

Edited January 29, 2025 by PaddyNewman

[Sheridan]

Presumably you mean don't apply as they've already made it through the WAN. The access-list entries apply in the ASA level, but control-plane rules are pre WAN so should be stopped before hand.

 

Are you cli managing. I don't know any other method but having a nose I've got this...

 

access-list block-test extended deny tcp host 5.1.77.3 10.255.0.1 eq 443

access-group block-test in interface outside control-plane

 

My ASA is 10.255.0.1.

 

It's been a while since I tried or monitored a VPN on this device as ASA is ... Well I don't have software or hardware support or patches, it's a personal device.

 

Thankfully it still runs!

 

Thanks I’ll have a look at his, I’ve only really used the adsm so far

 

I guess I can create a network group with multiple dodgy IPs and then apply the control plane rule to that

 

I suppose at least it’s working, the accounts are locking before they even get a chance to mfa but as they know a couple of accounts it’s a pain when they’re constantly locking!

[PaddyNewman]

Yeah, that is possible, I've never used adsm so it's always been smashed into the CLI but the control-plane part is key and if I'm being honest, no idea where that would be within the GUI management.

[Sheridan]

Sadly it looks like this won't work, just checked and the set of IP's has changed a few times, so its almost impossible to build a block list!

 

Its only because they're hitting a couple of valid account names that its an issue - as they keep locking out!