PIX ACL not hitting

cminard — Mon, 11 Mar 2019 11:07:09 GMT

I'm new at PIX configuration and have the following pb :

I have 2 PIX connected via VPN LAN-to-LAN.

Network_A behind PIX_A and network_B behind PIX_B can fully communicate.

Then I want to prevent one PC (PC_A) from network_A to communicate with one PC (PC_B) in network_B.

To do that, I configured an ACL on PIX_A :

access-list ACL_A_inside deny ip host <PC_A IPaddr> host <PC_B IPaddr>

access-list ACL_A_inside permit ip <network_A> <network_mask> <network_B> <network_mask>

access-list ACL_A_inside deny ip any any

access-group ACL_A_inside in interface inside

The problem is that PC_A can still initiate the communication (ping, http ...) to PC_B and when issuing the sh access-list ACL_A_inside command, I have 0 hitcnt nor for the deny ACE concerning the 2 PCs, neither for the permit ACE concerning the networks.

I only have 2 or 3 matches for the last deny ip any any but appeared before trying to ping or http from PC_A to PC_B.

I can't understand. All is getting as if I had no ACL configured, or no deny ACE.

Can anyone help me please ?

Thanks in advance

Re: PIX ACL not hitting

acomiskey — Wed, 05 Sep 2007 15:17:53 GMT

You will have to remove the sysopt connection permit-ipsec or permit-vpn command. This will cause all of your ipsec vpn traffic to have to be allowed in any of your interface acls.

topic PIX ACL not hitting in Network Security

PIX ACL not hitting

Re: PIX ACL not hitting