I upgraded to 8.4 some time ago and I guess a lot of the NAT rules changed. The migration seemed to have gone flawlessly, but this afternoon I realized that I could SSH into a box inside my network from the WAN even though the Access-list rule was disabled. (I used to just disable the access-list rule and all NAT would be cut off as well).
Now, as long as the NAT rule exists one can simply SSH into a machine on my network.. though a user/password is required this is not ideal.
Here's what I have:
object network Server_SSH
nat (inside,outside) static interface service tcp ssh ssh
access-list inbound extended permit tcp any host 10.0.0.6 eq ssh inactive
access-group inbound in interface outside
regardless if the access-list is inactive or not the 5505 still allows the NAT to occur and outside access is allowed. What am I missing?