I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering.

Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some tunnels. Also there is an access list applied inbound that denies all traffic:

access-list Network_Internet_access_in extended deny ip any any log notifications

My question is around the logic of the ASA, how come the tunnels is still up if there is an access list that denies everything ? I mean the ACL is applied inbout but what if the tunnel is started from the peer and not originated by the ASA.

Is this an inbuilt rule that the cryptomap communication will bypass the ACL ? If that is the case are there also other situations like this that would bypass the ACL, for example a AnyConnect VPN ?

closed as too broad by user36472, Ron Maupin Nov 23 '18 at 22:06

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    You will need to post your config in order to get an accurate answer. There are too many variables that could come into play. – Jesse P. Aug 23 '18 at 22:39

The access-list line you pasted shows an access list being defined, however that does not necessarily mean it is applied.

Assuming it is applied with an access-group, the reason you are still able to establish tunnels is because access-group controls traffic forwarded through the ASA, it does not apply to traffic destined to the ASA directly ("to-the-box") unless you add the control-plane keyword as described here

Not the answer you're looking for? Browse other questions tagged or ask your own question.