Implicit Rule on PIX 515 wont allow traffic

[Pete89]

I have a PIX 515e running 8.0.(4) and I am having problems getting the an ACL on the outside interface to work. This is not in ptoduction, so at this point I just want to see if  can get traffic to come in.

access-list OUTSIDE extended permit icmp any any
access-list OUTSIDE extended permit ip any any
access-list OUTSIDE extended permit tcp any any eq https

access-group OUTSIDE in interface outside

And when I try to hit port 443 on the outside interface I get shut out. Here is the output of the packet tracer:

testfw-hvn-pix515# packet-tracer input outside tcp 10.1.1.1 24552 172.31.1.6 443

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   172.31.1.6      255.255.255.255 identity

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

It says the implicent rule is stopping the traffic. My understanding is the implicent rule is only used when no access list is applied to an interface, but as you can see I have an ACL applied to the outside interface.

Confused,

P

[cadet alain]

Hi,

You want to communicate with your router in https or you want to communicate with a machine inside which is natted to outside address?

If if you want first one then you have to issue http enable outside

if this is second option then you must first do static pat: static(inside,outside) 443 443

Regards.

[Pete89]

Thanks for you answer.

Here is the setup. My edge router is doing a one to one NAT with the ouside interface of the FW:

router# ip nat inside source static 172.31.1.6 99.99.99.99.99

Where 172.31.1.6 is the outside interface of my firewall.

The idea was when site to site VPN traffic hits the public IP 99.99.99.99 it would sent it to the FW. I thought I would then need to have the FW's outside interface ready to accept that traffic by tweaking the ACL. So thats not the case??