Any Less Secure Network Rule.

Answered Question
Sep 21st, 2010

Hi,

Im a little confused about the logic of this rule on the ASA 5510, basically i have the following interfaces set to the following security levels:

Inside: 100

DMZ: 4

Outside: 0

The DMZ has a rule by default which allows any traffic to a less secure network, but when i add a rule on that interface so that the dmz can push limited traffic to the inside network for our exchange server it disapears.  Does this mean that now that rule has gone if i want that interface to have internet access via the outside interface i have to add a rule in?  or will it still allow traffic to lower interfaces?  if not is there anyway to add the rule back in and have additional rules on an interface to a higher security interface?

Hope that makes sense.

Thanks in advance for the help

David

I have this problem too.
0 votes
Correct Answer by Jennifer Halim about 6 years 2 months ago

As access-list is analysed top to bottom, here is what you would need to configure to achieve your requirement:

access-list permit tcp host eq

access-list deny ip

access-list permit ip any

So basically you would need to configure traffic that you would like to allow from dmz towards inside first, then ACL to deny traffic from dmz towards inside, and lastly to allow traffic from dmz to internet.

Hope that helps.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jennifer Halim Wed, 09/22/2010 - 00:13

As access-list is analysed top to bottom, here is what you would need to configure to achieve your requirement:

access-list permit tcp host eq

access-list deny ip

access-list permit ip any

So basically you would need to configure traffic that you would like to allow from dmz towards inside first, then ACL to deny traffic from dmz towards inside, and lastly to allow traffic from dmz to internet.

Hope that helps.

Actions

This Discussion

Related Content