Firewall Rule

[Jay Cambell]

I'm getting a block and I don't understand why.  I used the  ASDM tool to packet trace. Tried a telnet to the 10.0.0.0 and port and it work. When I test remote it doesn't work.  Its blocked.

Object network obj-10.0.0.0

host 10.0.0.0

Obj network obj-10.0.0.0

nat (inside, outside) 12.0.0.0 service tcp ssh ssh

Obj network obj-10.0.0.0

nat (inside, outside) 12.0.0.0 service tcp 990 990

Acl inside extended permit tcp host 10.0.0.0 host 12.0.0.0 eq ssh

Acl inside extended permit tcp host 10.0.0.0 host 12.0.0.0 eq 990

Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq ssh

Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq 990

[Rahul Govindan]

Your inbound ACL rule below seems to be wrong

Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq ssh
Acl outside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq 990

These rules should ideally be (considering ASA is version 8.3+):

Acl outside extended permit tcp any host 10.0.0.0 eq ssh
Acl outside extended permit tcp any host 10.0.0.0 eq 990

Your Acl inside should also change accordingly.

[Jay Cambell]

Are you saying the inbound should look like the below? Can you explain the difference? 

Acl inside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq ssh

Acl inside extended permit tcp host 12.0.0.0 host 10.0.0.0 eq 990

[Jay Cambell]

Or inbound should look like this. 

Acl inside extended permit tcp any host 12.0.0.0 eq ssh
Acl inside extended permit tcp any host 12.0.0.0 eq 990