Network Feed in an ACL on Firepower

[sasha]

Hello. Is it possible to create an ACL on Firepower which gets IP adresses to block from a network feed?

We have a custom network feed, auto-populated on a given number of failed RA VPN login attempts in a time interval. The feed is on a RADIUS server which authenticates RA VPN users.

So, we want to block IP addresses in the feed from connecting to the RA VPN. But as far as I see, the only way to block RA VPN by IP is a control plane ACL via FlexConfig.

Any ideas? Thanks.

[Rob Ingram]

@sasha yes you can create feeds to block IP address, but that is for traffic "through" the firewall and will not help you block traffic "to" the firewall for RAVPN connections.

Your options are (currently) block using control-plane ACL via FlexConfig, ACL on upstream switch or use a MFA solution with Geolocation.