Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I upgraded to 8.4 some time ago and I guess a lot of the NAT rules changed. The migration seemed to have gone flawlessly, but this afternoon I realized that I could SSH into a box inside my network from the WAN even though the Access-list rule was disabled. (I used to just disable the access-list rule and all NAT would be cut off as well).

Now, as long as the NAT rule exists one can simply SSH into a machine on my network.. though a user/password is required this is not ideal.

Here's what I have:

object network Server_SSH
nat (inside,outside) static interface service tcp ssh ssh

access-list inbound extended permit tcp any host eq ssh inactive
access-group inbound in interface outside

regardless if the access-list is inactive or not the 5505 still allows the NAT to occur and outside access is allowed. What am I missing?

share|improve this question
That looks correct. Mind posting your entire config? –  Jason Berg Aug 28 '11 at 17:23
Hrmm. It seems maybe the 'inactive' flag changed. Before I think it used to disable the rule, now it just passes through to the next rule. I'm not entirely sure if that was a bug or what. –  Mindflux Aug 28 '11 at 17:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.