Pix security level

Unanswered Question
Mar 28th, 2007
User Badges:

Hi


We use security level 0 outside and 100 in inside. but when we use security level other interface (dmz) then 50 or 30 or 20. so my question is what is security difference 50 ,30, 20 ?.

when i use 50 or 30 or 20 ??


thanks

Biplob

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Jon Marshall Thu, 03/29/2007 - 00:24
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi


By default the pix allows traffic to flow from a higher to a lower interface. If you want traffic to flow from a lower to higher you need to allow that traffic with an access-list.


So the difference in security numbers are eg.


You create a dmz (DMZ1) with a security number of 50

You create a dmz (DMZ2) with a security number of 40.


Traffic from DMZ1 is allowed to go through the outside interface and through DMZ2 without an access-list.

To go from DMZ1 to the inside would require an access-list.


Traffic from DMZ2 is allowed to go through the outside interface without an access-list.

To go from DMZ2 to DMZ1 or to the inside requires an access-list.


So you choose the numbers for your DMZ's based on how secure that DMZ is in relation to the other DMZ's.


HTH


Jon

iqbalkhan Thu, 03/29/2007 - 00:57
User Badges:

Hi


your explation clear but not full clear.

you give example DMZ1 and DMZ2.


example : I have 1 Pix.


first time I configure:


if I have out o inside 100 and DMZ50


2nd Time I configure:


and again I aasign out 0 inside 100 and Dmz 40


so difference 50 and 40 what i get advantage or disadvantage.


thanks

Biplob

Jon Marshall Thu, 03/29/2007 - 01:08
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi


If you only have one DMZ it really makes no difference. 40 or 50 are both greater than 0 and less than 100 (your outside and inside interfaces) so whichever number you use it will have the same effect.


HTH


Jon

afsharmilad89 Sun, 12/18/2016 - 22:57
User Badges:

Hello Guys,

Thanks for your information, it was really helpful for me in such a case.

Regards

Milad

Actions

This Discussion