Direction of ACL traffic flow

Question

                   Hi Everyone,
Need to confirm below that log
%ASA-6-106100: access-list Test_access_in denied tcp Test/172.24.x.x(443) -> Test/172.16.x.x(53310) hit-cnt 1 first hit [0x55b05541, 0x7c3c1e84]
Does this mean that traffic from interface Test on port 443   to interface Test1 of ASA is denied as there is no acl to allow trafic from 172.24  to 172.16?
or is this other way around?
Regards
Mahesh

Answer 1

Hi Jouni,
I  found this from ASA -syslog message pdf
Error Message %ASA-4-106100: access-list acl_ID {permitted | denied | est-allowed}
protocol interface_name/source_address(source_port) (idfw_user, sg_info)
interface_name/dest_address(dest_port) (idfw_user, sg_info) hit-cnt number
({first hit | number-second interval}) hash codes
So as per this the source is Test1 interface and going to Destination interface Test.The reason it was denied due to Asymmetric route.
Also from Cisco site
For
example, if an ACK packet is received on the ASA (for which no TCP connection exists in the
connection table), the ASA might generate message 106100, indicating that the packet was
permitted; however, the packet is later correctly dropped because of no matching connection.
so due to above reason the packet was dropped.
Best regards
Mahesh