RAVPN Geolocation-Based Policy Configuration for Secure Firewall FTD Version Requirements

• Issue
• Environment
• Resolution
• Cause
• Related Content

Issue

An access control policy configured with geolocation-based filtering rules for AnyConnect Secure Sockets Layer Virtual Private Network (SSL VPN) connections is not functioning as expected. The policy includes a rule specifically designed to allow AnyConnect SSL VPN connections originating from Saudi Arabia only. The geolocation-based access control policy feature that these rules depend upon to identify and filter traffic based on the country of origin is not working on the current Cisco Secure Firewall Threat Defense (FTD) v version 7.0.9.

Environment

• Cisco Secure Firewall Management Center (FMC)

• Cisco Secure Firewall Threat Defense (FTD) version 7.0.9

• Firepower Application Control with Geolocation services

• AnyConnect SSL VPN configuration with geolocation-based access control rules

• Access control policy configured with country-specific filtering

Resolution

The geolocation-based access control policy for RAVPN feature requires FTD version 7.7 or later to function properly. Since the current environment is running FTD version 7.0.9, an upgrade is necessary to resolve this issue.

• FMC upgrade priority: The FMC must be upgraded first and must be running a version equal to or higher than the target FTD version. Ensure FMC is upgraded accordingly before upgrading FTD.

• Configuration backup: Take a full backup of both FMC and FTD configurations before initiating the upgrade process.

• Maintenance window: Plan for a maintenance window as the upgrade process requires device reboots and can cause temporary traffic interruption.

• Release notes review: Review the release notes for each interim version and the target version for any known issues or caveats.

Cause

The geolocation-based access control policy feature for Remote Access Virtual Private Network (RAVPN) is only supported starting from FTD version 7.7 and later. The current FTD version 7.0.9 does not include support for this feature, which prevents the geolocation-based filtering rules from functioning correctly in the access control policy.

Related Content

• Configure Geolocation-Based Policies for Secure Firewall Threat Defense

• Cisco Secure Firewall Threat Defense Software Download - Version 7.7.11

• Cisco Secure Firewall Management Center Upgrade Planning Guide

• Cisco Technical Support & Downloads