Hi All
I have a strange one . I have an outside interface allowing only a few IP addresses inbound to a natted server. There is an implicit deny at the end
I have recently noticed attempts to log into this server from a random ( denined) IP .
The logs show it building a connection successfully , this is how it is able to reach the login page .
But the ACL is denying it . If I test with packet tracer on the firewall from the malicious IP to the server address it says it is blocked
Can any one explain how this could happen . I am concerned the ASA5525 ( 9.6 2 ) may have a bug but I cannot see any
Thanks
Craig
