block access rule does not works

[gogi99]

i have the firepower 1120 firewall, i have a network in DMZ zone. i natted my server and when i create block access rule for ping, this rule does not works. also, i noticed that my firewall allow all to my server, all open ports are allowed

[gogi99]

when i set default access rule on block nothing does not works

[Karsten Iwen]

Your access-rule doesn't work because you only block traffic from outside to outside.

For a firewall deployment you should use the default deny and allow everything you need. And pay attention on using the correct zones.

[gogi99]

if i set default deny, allowing port on natted device  i set access rule from any (outside zone) to local ip address of my server (172.16.20.x insied zone) or on natted ip address?

[Karsten Iwen]

You habe to use the real IP (that is the one used in the DMZ on the server) in your access-control rule.