ASA 5510 - Wide Open Configuration Assistance Needed

mtucker111 · ‎05-21-2009

I would like to insert an ASA 5510 into our network in transparent mode. I would like to begin by allowing all traffic to pass between the two interfaces unrestricted. How would I go about doing this?

I currently have access lists on both interfaces that read:

outside_access_in extended permit ip any any

inside_access_in extended permit ip any any

Outside interface security level = 99

Inside interface security level = 99

Same-security-traffic permit inter-interface is enabled.

Any thoughts are appreciated.

-Mike

Report Inappropriate Content · ‎05-27-2009

When the security appliance runs in transparent mode, the outbound interface of a packet is determined by a MAC address lookup instead of a route lookup. Route statements can still be configured, but they only apply to security appliance-originated traffic. For example, if your syslog server is located on a remote network, you must use a static route, so the security appliance can reach that subnet.

Kureli Sankar · ‎05-27-2009

Since you have same security, flow initiated from both sides will automatically be allowed without any need for access-list.

Pls. read this link below:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/intparam.html#wpxref49092

Allowing Communication Between Interfaces on the Same Security Level

By default, interfaces on the same security level cannot communicate with each other. Allowing communication between same security interfaces provides the following benefits:

â€¢You can configure more than 101 communicating interfaces.

If you use different levels for each interface and do not assign any interfaces to the same security level, you can configure only one interface per level (0 to 100).

â€¢You want traffic to flow freely between all same security interfaces without access lists.

hostname(config)# same-security-traffic permit inter-interface