Пробую разобраться в ASA под GNS3

настроил три интерфейса
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.10.1.1 255.255.255.0
!
interface Ethernet0/1
nameif DMZ
security-level 100
ip address 10.20.1.1 255.255.255.0
!
interface Ethernet0/2
nameif inside
security-level 100
ip address 10.30.1.1 255.255.255.0

Настроил NAT
nat (DMZ) 1 10.20.1.0 255.255.255.0
nat (inside) 1 10.30.1.0 255.255.255.0

global (outside) 1 interface

Навесил acl
access-list outside_in extended permit icmp any any echo-reply
access-group outside_in in interface outside

На интерфейсы подключил виртуальные машинки с ubuntu: inhost, outhost и dmzhost
ping c inhost и dmzhost до оuthost ходит, и в sh xla есть записи - NAT работает

теперь хотел пробросить порты 22 на inhost:22 и 222 на dmzhost:22

добавляю следующее

static (inside,outside) tcp 10.10.1.1 ssh 10.30.1.3 ssh netmask 255.255.255.255
static (DMZ,outside) tcp 10.10.1.1 222 10.20.1.3 ssh netmask 255.255.255.255
и
access-list outside_in extended permit tcp any host 10.10.1.1 eq ssh
access-list outside_in extended permit tcp any host 10.10.1.1 eq 222

по теории должно работать, а нет
пробую диагностировать
packet-tracer input outside tcp 10.10.1.2 1025 10.10.1.1 22

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
static (inside,outside) tcp 10.10.1.1 ssh 10.30.1.3 ssh netmask 255.255.255.255
  match tcp inside host 10.30.1.3 eq 22 outside any
    static translation to 10.10.1.1/22
    translate_hits = 0, untranslate_hits = 4
Additional Information:
NAT divert to egress interface inside
Untranslate 10.10.1.1/22 to 10.30.1.3/22 using netmask 255.255.255.255

Phase: 4
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.10.1.1       255.255.255.255 identity

Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Не пойму почему по ACCESS-LIST DROP?