Hi,
I'm trying to limit access to a remote site (192.168.233.0) connected via site-site vpn. I've applied an acl to the internal interface denying that traffic, but I can still get there (via ping). Also, rules that permit connectivity aren't registering hits even though i'm pinging through them.
Any hints?
pix# sh access-group access-group incoming001 in interface outside access-group outgoing003 in interface inside pix# pix# pix# sh access-list outgoing003 access-list outgoing003 permit tcp host 10.1.1.21 any eq smtp (hitcnt=13) access-list outgoing003 permit ip host 10.1.1.100 any (hitcnt=0) access-list outgoing003 permit ip 10.10.0.0 255.255.0.0 10.40.0.0
255.255.0.0 (hitcnt=0) access-list outgoing003 permit ip 10.10.0.0 255.255.0.0 10.20.0.0
255.255.0.0 (hitcnt=0) access-list outgoing003 permit ip 10.10.0.0 255.255.0.0 130.30.0.0
255.255.0.0 (hitcnt=0) access-list outgoing003 permit ip 10.10.0.0 255.255.0.0 130.80.0.0
255.255.0.0 (hitcnt=0) access-list outgoing003 permit ip host 10.1.1.18 192.168.233.0
255.255.255.0 (hitcnt=0) access-list outgoing003 permit ip host 10.1.1.26 192.168.233.0
255.255.255.0 (hitcnt=0) access-list outgoing003 permit ip host 10.1.1.10 any (hitcnt=23) access-list outgoing003 deny ip 10.10.0.0 255.255.0.0 192.168.233.0
255.255.255.0 (hitcnt=0) access-list outgoing003 deny ip 10.20.0.0 255.255.0.0 192.168.233.0
255.255.255.0 (hitcnt=0) access-list outgoing003 deny ip 10.40.0.0 255.255.0.0 192.168.233.0
255.255.255.0 (hitcnt=0) access-list outgoing003 deny tcp any any eq smtp (hitcnt=3) access-list outgoing003 deny tcp any any eq 135 (hitcnt=0) access-list outgoing003 deny udp any any eq 135 (hitcnt=0) access-list outgoing003 deny tcp any any eq 137 (hitcnt=0) access-list outgoing003 deny udp any any eq netbios-ns (hitcnt=51) access-list outgoing003 deny tcp any any eq 138 (hitcnt=0) access-list outgoing003 deny udp any any eq netbios-dgm (hitcnt=0) access-list outgoing003 deny tcp any any eq 139 (hitcnt=0) access-list outgoing003 deny udp any any eq 139 (hitcnt=0) access-list outgoing003 deny tcp any any eq 445 (hitcnt=0) access-list outgoing003 deny tcp any any eq 1433 (hitcnt=0) access-list outgoing003 deny tcp any any eq 1434 (hitcnt=0) access-list outgoing003 deny tcp any any eq 2869 (hitcnt=0) access-list outgoing003 deny udp any any eq tftp (hitcnt=0) access-list outgoing003 deny udp any any eq snmp (hitcnt=0) access-list outgoing003 deny udp any any eq snmptrap (hitcnt=0) access-list outgoing003 deny tcp any any eq 6666 (hitcnt=0) access-list outgoing003 deny tcp any any eq 6667 (hitcnt=0) access-list outgoing003 deny icmp any any (hitcnt=103) access-list outgoing003 deny udp any any eq ntp (hitcnt=3) access-list outgoing003 permit ip any any (hitcnt=5577)