Thanks for that

Where is it best to apply this access list? would I apply it outbound on the outside interface, allowing all traffic sourced from the dmz addresses? or do I apply it inbound into the dmz interface, add a deny statement first to any internal addresses, then allow dmz source to anywhere?

please help

cheers

Carl

Apply it in the DMZ inbound..

I would recommend applying it inbound to the DMZ, as you have said earlier, denying all DMZ access to the internal networks, then allowing access to anything on the Internet. It would also be good if you can have the second lowest security level applied to this wireless DMZ connection. Assuming that your outside interface has security level of 0, then you would want to apply just a slightly better security level for DMZ (with DMZ security level being the lowest compared to all other internal network interfaces).

hi there

So is it OK to have my security level, 100 for inside, dmz 50, 0 for outside as standard ?

Sure,

Normally the outside has a security level of 0, the inside of 100 and if having a single DMZ a security level of 50.

If having more DMZs, you can assign between (1-99)

Federico.

yes, 50 sounds good to me.

As Federico said, if it's just a single DMZ, then you can use any number between 1-99.