Добрый День !!!

Тренируюсь с FWSM модулями настроил тестовую сеть но немогу понять почему не проходят пакеты. Вроде специально прописал access lists уже на всех интерфейсах но все равно

%FWSM-3-106010: Deny inbound tcp src to_msfc:10.17.14.251/61954 dst Net_24.0:10.17.24.251/443
%FWSM-3-106010: Deny inbound tcp src to_msfc:10.17.14.251/61954 dst Net_24.0:10.17.24.251/443
%FWSM-3-106010: Deny inbound tcp src to_msfc:10.17.14.251/61971 dst Net_24.0:10.17.24.251/80
%FWSM-3-106010: Deny inbound tcp src to_msfc:10.17.14.251/61971 dst Net_24.0:10.17.24.251/80
%FWSM-3-106010: Deny inbound tcp src to_msfc:10.17.14.251/61954 dst Net_24.0:10.17.24.251/443

и почемуто не отрабатываются access-list

# sh access-list

access-list mode auto-commit

access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)

            alert-interval 300

access-list to_perm; 5 elements

access-list to_perm line 1 extended permit ip any any log informational interval 300 (hitcnt=0) 0x358d3ccf

access-list to_perm line 2 extended permit icmp any any log informational interval 300 (hitcnt=0) 0x99ef4eae

access-list to_perm line 3 extended permit tcp any any log informational interval 300 (hitcnt=0) 0x5b860d43

access-list to_perm line 4 extended permit udp any any log informational interval 300 (hitcnt=0) 0x9d85bf6a

access-list to_perm line 5 extended deny ip any any log informational interval 300 (hitcnt=0) 0x802da8fc

Конфиг

FWSM Version 4.1(3)

!

hostname
domain-name 111

enable password 111 encrypted

names

dns-guard

!

interface Vlan23

nameif Net_24.0

security-level 50

ip address 10.17.24.4 255.255.255.0 standby 10.17.24.1

!

interface Vlan241

description FWSM-TO-CMFS

nameif to_msfc

security-level 30

ip address 10.17.254.242 255.255.255.248 standby 10.17.254.243

!

interface Vlan242

description LAN Failover Interface

!

interface Vlan243

description STATE Failover Interface

!

passwd 111 encrypted

ftp mode passive

dns domain-lookup to_msfc

dns name-server 10.17.113.7

dns name-server 10.17.141.3

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list to_perm extended permit ip any any log

access-list to_perm extended permit icmp any any log

access-list to_perm extended permit tcp any any log

access-list to_perm extended permit udp any any log

access-list to_perm extended deny ip any any log

pager lines 24

logging enable

logging buffered debugging

logging asdm informational

logging host to_msfc 10.17.131.65

logging host to_msfc 10.17.11.247

logging debug-trace

mtu Net_24.0 1500

mtu to_msfc 1500

failover

failover lan unit primary

failover preempt

failover lan interface fail_over Vlan242

failover polltime unit 1 holdtime 3

failover key *****

failover replication http

failover link state_full Vlan243

failover interface ip fail_over 192.168.1.1 255.255.255.0 standby 192.168.1.2

failover interface ip state_full 192.168.2.1 255.255.255.0 standby 192.168.2.2

icmp permit any Net_24.0

icmp permit any to_msfc

asdm history enable

arp timeout 14400

nat-control

access-group to_perm in interface Net_24.0

access-group to_perm out interface Net_24.0

access-group to_perm in interface to_msfc

access-group to_perm out interface to_msfc

!

router ospf 1

network 10.17.24.0 255.255.255.0 area 2

network 10.17.254.240 255.255.255.248 area 0

router-id 10.17.254.242

log-adj-changes

!

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-invite 0:03:00 sip-disconnect 0:02:00

timeout pptp-gre 0:02:00

timeout uauth 0:05:00 absolute

username gggg

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.17.0.0 255.255.0.0 to_msfc

no snmp-server location

no snmp-server contact

snmp-server community 111

snmp-server enable traps snmp authentication linkup linkdown coldstart

service reset no-connection

no service reset connection marked-for-deletion

telnet timeout 5

ssh 10.17.0.0 255.255.0.0 to_msfc

ssh timeout 60

console timeout 60

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class inspection_default

  inspect dns maximum-length 512

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect netbios

  inspect rsh

  inspect skinny

  inspect smtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

  inspect http

  inspect snmp

!

service-policy global_policy global

smtp-server 10.17.3.219

prompt hostname context

Cryptochecksum:6f399ce4e1b8a919f951a9f837821018

: end