topic Or inbound should look like in Network Security

Firewall Rule

Jay Cambell — Tue, 12 Mar 2019 09:48:08 GMT

I'm getting a block and I don't understand why. I used the ASDM tool to packet trace. Tried a telnet to the 10.0.0.0 and port and it work. When I test remote it doesn't work. Its blocked.

Object network obj-10.0.0.0

host 10.0.0.0

Obj network obj-10.0.0.0

nat (inside, outside) 12.0.0.0 service tcp ssh ssh

Obj network obj-10.0.0.0

nat (inside, outside) 12.0.0.0 service tcp 990 990

Acl inside extended permit tcp host 10.0.0.0 host 12.0.0.0 eq ssh

Acl inside extended permit tcp host 10.0.0.0 host 12.0.0.0 eq 990

Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq ssh

Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq 990

Your inbound ACL rule below

Rahul Govindan — Thu, 10 Aug 2017 00:55:45 GMT

Your inbound ACL rule below seems to be wrong

Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq ssh
Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq 990

These rules should ideally be (considering ASA is version 8.3+):

Acl outside extended permit tcp any host 10.0.0.0 eq ssh
Acl outside extended permit tcp any host 10.0.0.0 eq 990

Your Acl inside should also change accordingly.

Are you saying the inbound

Jay Cambell — Thu, 10 Aug 2017 01:59:11 GMT

Are you saying the inbound should look like the below? Can you explain the difference?

Acl inside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq ssh

Acl inside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq 990

Or inbound should look like

Jay Cambell — Thu, 10 Aug 2017 02:30:22 GMT

Or inbound should look like this.

Acl inside extended permit tcp any host 12.0.0.0 eq ssh
Acl inside extended permit tcp any host 12.0.0.0 eq 990