I'm having some trouble with Access Rules on a Cisco ASA 5525. The rule I want the ASA to use is the following:
access-list global_access line 1 extended permit ip range 192.168.1.3 192.168.1.233 interface net (hitcnt=0) 0xcc058868
The rule which is used instead is this one:
access-list global_access line 22 extended deny ip 192.168.1.64 255.255.255.192 any (hitcnt=54) 0x15d9372b
An example log entry for the latter rule:
4 Mar 07 2018 15:07:13 106023 192.168.1.89 53320 --public DNS server-- 53 Deny udp src mais:192.168.1.89/53320 dst net:--public DNS server--/53 by access-group "global_access" [0x966f215f, 0x15d9372b]
The destination obviously is on interface net so I have no clue why this isn't working. --public DNS server-- is a public IP address outside any configured network range.
If I use any instead of net in rule 1 everything works as intended, except that I don't want to use any.