Im a little confused about the logic of this rule on the ASA 5510, basically i have the following interfaces set to the following security levels:
The DMZ has a rule by default which allows any traffic to a less secure network, but when i add a rule on that interface so that the dmz can push limited traffic to the inside network for our exchange server it disapears. Does this mean that now that rule has gone if i want that interface to have internet access via the outside interface i have to add a rule in? or will it still allow traffic to lower interfaces? if not is there anyway to add the rule back in and have additional rules on an interface to a higher security interface?
Hope that makes sense.
Thanks in advance for the help
As access-list is analysed top to bottom, here is what you would need to configure to achieve your requirement:
access-list permit tcp host eq
access-list deny ip
access-list permit ip any
So basically you would need to configure traffic that you would like to allow from dmz towards inside first, then ACL to deny traffic from dmz towards inside, and lastly to allow traffic from dmz to internet.
Hope that helps.