I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering.
Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some tunnels. Also there is an access list applied inbound that denies all traffic:
access-list Network_Internet_access_in extended deny ip any any log notifications
My question is around the logic of the ASA, how come the tunnels is still up if there is an access list that denies everything ? I mean the ACL is applied inbout but what if the tunnel is started from the peer and not originated by the ASA.
Is this an inbuilt rule that the cryptomap communication will bypass the ACL ? If that is the case are there also other situations like this that would bypass the ACL, for example a AnyConnect VPN ?