Security levels on ASA

Andy White · ‎12-02-2009

Hello,

I'm trying to allow traffic between 2 VLAN's/sub interfaces on my ASA, the both have their security Level set at 25. At the moment I can't even ping devices between the 2 and my access lists are wide open. I raised one of the security groups to 35 and everything seem to work.

I'm left a little confused, if security levels are the same are the untrusted? What ever I did on the access list side (to open it up) seemed to be ignored.

johnbroadway · ‎12-02-2009

hi,

have you tried enabling the same level intra-interface communications. Here's a link all about it:

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml

hostname(config)# same-security-traffic permit inter-interface

regards

John

Andy White · ‎12-02-2009

Thanks John,

Is this commonly enable by most, I set both these sub interfaces to the same as they sort of need resources from each, have the same security set like you mention is a good idea in my eyes.

johnbroadway · ‎12-02-2009

It is a fairly new option (I think since V7 ish) for your sort of instance.

If both interfaces require resources from the other then it seems a reasonable approach to me.

John