same security levels on 2 interfaces on ASA 7.x

Answered Question
Apr 6th, 2008
User Badges:
  • Bronze, 100 points or more

If i have 2 interfaces with the same security level on ASA running 7.x code, with " same-security-traffic permit inter-interface " enabled and also an acl in place on both those interfaces, will the implicit permit be still effective between the same security level interfaces or will the acl take effect ?


thanks,

Vikram

Correct Answer by JORGE RODRIGUEZ about 9 years 1 month ago

no it will not, the command will bypass ACLs, in other words acl has not precedence over the command.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
JORGE RODRIGUEZ Sun, 04/06/2008 - 12:57
User Badges:
  • Green, 3000 points or more

Vikram, one of the purposes of same-security-traffic permit inter-interface command is to allow communications between interfaces with same interface security level without the use of access lists, so if this is what you are trying to accomplish then any permit rules between these same security interfaces can technically be decomissioned as this command will permit traffic between the two.



http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s1_72.html#wp1289167


HTH

Rgds

Jorge

vikram_anumukonda Sun, 04/06/2008 - 20:00
User Badges:
  • Bronze, 100 points or more

this answers part of the question, but what if i have "same-security-traffic permit inter-interface" and access-list configured on the interfaces with same security-level,


Question: will this make "same-security-traffic permit inter-interfae" command ineffective ??



thanks,

vikram

Correct Answer
JORGE RODRIGUEZ Sun, 04/06/2008 - 20:08
User Badges:
  • Green, 3000 points or more

no it will not, the command will bypass ACLs, in other words acl has not precedence over the command.

vikram_anumukonda Sun, 04/06/2008 - 20:16
User Badges:
  • Bronze, 100 points or more

it answers my question, i have rated your response


-vikram

JORGE RODRIGUEZ Sun, 04/06/2008 - 22:06
User Badges:
  • Green, 3000 points or more

Vikram, I am glad I was help to clarify your question, I thank you for using the rating system as it encourages all participating in forums to go the extra mile.


Rgds

Jorge

Actions

This Discussion