I found by accident that access which wasn't explicitly permitted in ACLs still was able to went through. This only seem to happen when the src originates from a site-to-site vpn and a ciient vpn. A permit rule does not increase the counter, a deny does but traffic is let through anyway. What could be the cause of this? I don't have sysopt permit-vpn.
interface "ldap"
access-group ldap_access_in in interface ldap
access-group ldap_access_out out interface ldap
I had zero hits until I started to try ssh;
access-list ldap_access_out line 1 extended deny tcp host 10.99.2.70 host 10.99.11.8 eq ssh (hitcnt=5) 0xa18d6298
If I wait ten minutes without connecting, no hits. Checking on the remote host who is logged on I can see that the source address is what I expect it to be, and capture captures the traffic.
4 minutes after the previous tries, I will now connect three times and check the hit count:
[user@ldap0 ~]$ ssh 10.99.11.8
Last login: Thu Nov 20 13:48:34 2014 from 10.99.2.70
[user@root0 ~]$ logout
Connection to 10.99.11.8 closed.
[user@ldap0 ~]$ ssh 10.99.11.8
Last login: Thu Nov 20 13:53:23 2014 from 10.99.2.70
[user@root0 ~]$ ^C
[user@root0 ~]$ logout
Connection to 10.99.11.8 closed.
[user@ldap0 ~]$ ssh 10.99.11.8
Last login: Thu Nov 20 13:53:24 2014 from 10.99.2.70
[user@root0 ~]$ logout
Connection to 10.99.11.8 closed.
And ...
access-list ldap_access_out line 1 extended deny tcp host 10.99.2.70 host 10.99.11.8 eq ssh (hitcnt=8) 0xa18d6298
