ASA acl rule hit count no increase for a while, show connection get nothing

[zhaochunhong]

We worked on cleanup firewall rules on ASA, some acl rules no hit increased over months and show connection also get none, but when we removed the rules impact and caused incident and found most rules related to ssh. any reason can cause it and what's the cleanup steps besides compare hit count and show connection can avoid the impact?

e.g. our rule: 

access-list PRD-FF_IN line 464 extended permit tcp host 10.1.75.169 host 52.1.88.135 eq ssh log informational interval 300 (hitcnt=1)

[TJ-20933766]

Aside from looking at the ACL hits, you could analyze packet captures. Look at source and destination IP addresses and port numbers. It might be pretty tedious but you would be able to see all the traffic traversing the ASA even if that traffic doesn't show as a hit on any ACL rule. Then once you've identified the traffic that should be allowed, tailor your ACL rules accordingly.

[zhaochunhong]

thanks, capture is good idea, more reliable then show connection, the weird is the hit count how come didn't increase 

[zhaochunhong · Accepted solution]

ASA cluster reason, all traffic on other node of Cluster. 

[zhaochunhong]

this command: cluster exec show access-list