up vote 0 down vote favorite
share [g+] share [fb]

I upgraded to 8.4 some time ago and I guess a lot of the NAT rules changed. The migration seemed to have gone flawlessly, but this afternoon I realized that I could SSH into a box inside my network from the WAN even though the Access-list rule was disabled. (I used to just disable the access-list rule and all NAT would be cut off as well).

Now, as long as the NAT rule exists one can simply SSH into a machine on my network.. though a user/password is required this is not ideal.

Here's what I have:

object network Server_SSH
host 10.0.0.6
nat (inside,outside) static interface service tcp ssh ssh

access-list inbound extended permit tcp any host 10.0.0.6 eq ssh inactive
access-group inbound in interface outside

regardless if the access-list is inactive or not the 5505 still allows the NAT to occur and outside access is allowed. What am I missing?

link|improve this question
50% accept rate
That looks correct. Mind posting your entire config? – Jason Berg Aug 28 '11 at 17:23
Hrmm. It seems maybe the 'inactive' flag changed. Before I think it used to disable the rule, now it just passes through to the next rule. I'm not entirely sure if that was a bug or what. – Mindflux Aug 28 '11 at 17:48
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.