Access-lists sur Cisco ASA

Bonjour et déjà merci de ta réponse.

L'access-list Acl_PROTECTION_SERVEURS est là pour bloquer le RDP depuis le LAN_POSTES vers le LAN_SERVEURS. J'ai testé de différentes façons, sans résultat ; il me manque qq chose... 

Ci-dessous la config du Cisco ASA, élaguée de tous les VPN site à site, objets, redirections, users, etc. Je précise que cette config fonctionne bien depuis des années, il n'y a que cette ACL qui s'obstine à m'embêter...

Merci d'avance de tes remarques et Joyeux Noël ! Christophe

: Serial Number: xxx
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
: Written by AdministrAteur at 10:20:57.478 CEST Sat Dec 21 2024
!
ASA Version 9.12(1)2
!
terminal width 150
hostname xxx
domain-name xxx
enable password xxx encrypted
names
no mac-address auto
ip local pool Pool_IP_VPN 10.0.2.1-10.0.2.14 mask 255.255.255.240
!
interface GigabitEthernet1/1
 description Interface externe
 nameif Int_NET
 security-level 0
 ip address xxx 255.255.255.248
!
interface GigabitEthernet1/2
 description Interface DMZ
 nameif Int_DMZ
 security-level 50
 ip address 10.0.1.254 255.255.255.0
!
interface GigabitEthernet1/3
 description Interface Lan postes
 nameif Int_LAN_POSTES
 security-level 100
 ip address 192.168.2.254 255.255.254.0
!
interface GigabitEthernet1/7
 description Interface Lan serveurs
 nameif Int_LAN_SERVEURS
 security-level 100
 ip address 192.168.4.254 255.255.255.0
!
interface Management1/1
 description Interface Management
 management-only
 nameif Int_MGT
 security-level 100
 ip address 172.16.15.254 255.255.255.0
!
!time-range Weekdays
 periodic Friday 8:30 to 18:30
 periodic Monday Tuesday Wednesday Thursday 8:30 to 19:30
!
boot system disk0:/asa952-lfbff-k8.SPA
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup Int_LAN_SERVEURS
dns server-group DefaultDNS
 name-server 192.168.4.xxx Int_LAN_SERVEURS
 name-server 192.168.4.xxx Int_LAN_SERVEURS
 domain-name xxx
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network Net_LAN_POSTES
 subnet 192.168.2.0 255.255.254.0
 description Reseau interne postes
object network Net_LAN_SERVEURS
 subnet 192.168.4.0 255.255.255.0
 description Reseau interne serveurs
object network Net_DMZ
 subnet 10.0.1.0 255.255.255.0
 description Reseau DMZ
object network Net_VPN_CLIENT
 subnet 10.0.2.0 255.255.255.224
 description Postes connectes en VPN Client
object service RDP
 service tcp source eq 3389
 description RDP natif PC et serveurs
access-list Acl_VPN_CLIENT standard permit 192.168.2.0 255.255.254.0
access-list Acl_VPN_CLIENT standard permit 192.168.4.0 255.255.255.0
access-list Acl_PROTECTION_SERVEURS extended deny tcp object Net_LAN_POSTES object Net_LAN_SERVEURS eq 3389
access-list Acl_PROTECTION_SERVEURS extended permit ip any any
pager lines 24
logging enable
logging timestamp
logging trap informational
logging asdm informational
logging from-address xxx
logging host Int_LAN_POSTES 192.168.2.xxx
mtu Int_NET 1500
mtu Int_DMZ 1500
mtu Int_LAN_POSTES 1500
mtu Int_LAN_SERVEURS 1500
mtu Int_MGT 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
icmp permit any Int_LAN_POSTES
icmp permit any Int_LAN_SERVEURS
asdm image disk0:/asdm-7121.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (Int_LAN_POSTES,Int_NET) source static Net_LAN_POSTES Net_LAN_POSTES destination static Net_VPN_CLIENT Net_VPN_CLIENT no-proxy-arp route-lookup
nat (Int_LAN_SERVEURS,Int_NET) source static Net_LAN_SERVEURS Net_LAN_SERVEURS destination static Net_VPN_CLIENT Net_VPN_CLIENT no-proxy-arp route-lookup
nat (Int_DMZ,Int_NET) source dynamic Net_DMZ interface
nat (Int_LAN_POSTES,Int_NET) source dynamic Net_LAN_POSTES interface
nat (Int_LAN_SERVEURS,Int_NET) source dynamic Net_LAN_SERVEURS interface
nat (Int_LAN_POSTES,Int_NET) source dynamic Net_Salons interface
access-group Acl_ENTREE in interface Int_NET
access-group Acl_PROTECTION_SERVEURS in interface Int_LAN_POSTES
route Int_NET 0.0.0.0 0.0.0.0 xxx 1
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authentication serial console LOCAL
aaa authorization command LOCAL
aaa authorization exec LOCAL auto-enable
aaa authorization http console LOCAL
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 Int_MGT
http 0.0.0.0 0.0.0.0 Int_LAN_POSTES
no snmp-server location
no snmp-server contact
no sysopt connection permit-vpn
service sw-reset-button
telnet 0.0.0.0 0.0.0.0 Int_LAN_POSTES
telnet 0.0.0.0 0.0.0.0 Int_MGT
telnet timeout 30
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access Int_LAN_POSTES

threat-detection basic-threat
threat-detection statistics host number-of-rate 2
threat-detection statistics port number-of-rate 3
threat-detection statistics protocol number-of-rate 3
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 193.50.27.66 source Int_NET
ntp server 195.220.94.163 source Int_NET
ntp server 212.37.192.31 source Int_NET prefer
tftp-server Int_LAN_POSTES 192.168.2.xxx /
group-policy GP_VPN_CLIENT internal
username AdminbAckup password xxx encrypted privilege 15
username AdministrAteur password xxx encrypted privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
  inspect icmp error
  inspect ipsec-pass-thru
  inspect pptp
 class class-default
  user-statistics accounting
!
service-policy global_policy global
smtp-server xxx
prompt hostname context
no call-home reporting anonymous
hpm topN enable
: end

Pas d'erreur en passant les commandes, le RDP n'est jamais bloqué, et c'est bien du Bureau à distance de base, donc à priori port 3389...