Scenario: Host A (trusted side of firewall) needs to talk to a web server on port 443 (untrusted side) Trusted rule exists on the Cisco ASA - permit Host_A Web_SVR port 443
The trusted rule should allow Host A to talk to the web server on port 443 and also allow the return traffic for that session through the firewall due to the session being initiated by the trusted source.
Everywhere I have read that the ASA is state full and return traffic rule should not be needed.
The problem is in my specific situation the ASA is denying the return traffic due to the source/destination ip's and protocols being reversed.
The question is what configurations exist in the default setup that make the Cisco ASA act in a stateful manner?
Historical Information: The stateful manner was working previously. We did an OS upgrade and received a new baseline config around the same time a few months ago. This is around when the issue started. I'm thinking it's a possible bug in the new IOS or a necessary config was overlooked or didn't take with the new IOS.
I've compared the old config and new config and there were a few object/service type syntax changes which were updated prior to loading the new config. I did not notice any failed commands when the new configs were loaded.
If you have any suggestions as to what I should try to look for I would appreciate it.