Have an existing ASA that has a config I inherited. Looking at the firewall I do not see a rule that allows traffic of a certain pattern to traverse the firewall. I do see the pattern applied for NAT'ing reasons and I'm curious, if you have a NAT policy defined, is that traffic able to bypass the firewall?
For example, I have one access list defined as:
access-list policy-nat extended permit udp object-group MY_OBJ any eq snmp
and another as
access-list firewall-list extended permit udp host 22.214.171.124 host 126.96.36.199 eq snmp
Both ACL's are applied to the same interface as such:
nat (my-int) 22 access-list policy-nat
access-group firewall-list in interface my-int
Will any traffic patterns that conform to the NAT rules bypass the access-group entries?