cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
811
Views
0
Helpful
4
Replies

Security level on ASA

kr_madan
Level 1
Level 1

Hi Experts,

If there are multiple sub interfaces and vlans are created with different security levels

Will the traffic flows from high security level interface to low security level interface?.

What is the case if we have the acls in place?

Thanks in advance

Regards,

Madan.

2 Accepted Solutions

Accepted Solutions

John Blakley
VIP Alumni
VIP Alumni

Madan,

The ASA always allows traffic from higher to lower by default. If you have ACLs in place, then you'll need to allow the traffic through.

For example, if you have an ACL applied to the inside interface and the inside interface has a security level of 100, then that ACL will need to allow what you want out. If you want users to be able to surf the web, but nothing else, your acl will allow port 80 out, but deny everything else.

HTH,

John

HTH, John *** Please rate all useful posts ***

View solution in original post

Depends on what you are trying to do with your acl.

There is an implicit deny at the end of an acl so anything not explicitly permitted or denied in your acl will be dropped.

Jon

View solution in original post

4 Replies 4

John Blakley
VIP Alumni
VIP Alumni

Madan,

The ASA always allows traffic from higher to lower by default. If you have ACLs in place, then you'll need to allow the traffic through.

For example, if you have an ACL applied to the inside interface and the inside interface has a security level of 100, then that ACL will need to allow what you want out. If you want users to be able to surf the web, but nothing else, your acl will allow port 80 out, but deny everything else.

HTH,

John

HTH, John *** Please rate all useful posts ***

Thanks for your valuable input.

Do we need Explicit deny statement in acl?

Depends on what you are trying to do with your acl.

There is an implicit deny at the end of an acl so anything not explicitly permitted or denied in your acl will be dropped.

Jon

In addition to what Jon said, if you use a permit any at the end of your acl and want to deny traffic, you'll need a deny line before the permit any.

deny ip 192.168.1.0 255.255.255.0 any eq 80

permit ip any any

This would deny 192.168.1.0 subnet from getting on the web, but it would allow them to go everywhere else like mail, etc. After the "permit ip any any" line is an "invisible" deny ip any any line. You can't see it but it's there. I normally put a deny ip any any at the end so I can see what I'm actually blocking hit-count wise.

John

HTH, John *** Please rate all useful posts ***
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: