ACL on ASA is not working

[your.ideas]

Hello everyone,

Easy question, but not for me :)

I am trying to modify an ACL on outside interface that allows THE ONLY PUBLIC IP to connect to the server 62.xxx.xxx.57 using SSH - see screenshot.

The existing rule permits any host from outside to do so. What I have done is changed ANY to 197.14.12.22 however it did not stopped ANY host from accessing the server via ssh. Please advise what I am doing wrong?

[Karsten Iwen · Accepted solution]

1. You only show that you changed this line, but are there more lines after that? One of them could allow ssh from "any".
2. If an ssh-session is already established, then this session won't be killed just because you change the ACL. An ongoing session has to be cleared manually. The next session uses the changed ACL to decide if the session should be allowed or not.
3. You don't need ip, icmp and tcp as the services. "ip" includes all ip-protocols. tcp and icmp are automatically allowed if you allow "ip".

[your.ideas]

Thanks a lot Karsten,

There really was any-any ip allow rule below. 2& especially 3 from you are very precisious advices for newbie like me.

[Karsten Iwen]

And remember that if you allow "ip" to a host, you are probably doing something in a sub-optimal way (or just wrong). Especially from the outside, only the ports that are really needed should be allowed.

[dmooregfb · Accepted solution]

If I understand what you are wanting to do, only allow the 197.x.x.x address to access the server via SSH, change the service from ip to tcp/ssh. 

Clear conn and test again.