Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Any Less Secure Network Rule.

Hi,

Im a little confused about the logic of this rule on the ASA 5510, basically i have the following interfaces set to the following security levels:

Inside: 100

DMZ: 4

Outside: 0

The DMZ has a rule by default which allows any traffic to a less secure network, but when i add a rule on that interface so that the dmz can push limited traffic to the inside network for our exchange server it disapears.  Does this mean that now that rule has gone if i want that interface to have internet access via the outside interface i have to add a rule in?  or will it still allow traffic to lower interfaces?  if not is there anyway to add the rule back in and have additional rules on an interface to a higher security interface?

Hope that makes sense.

Thanks in advance for the help

David

1 ACCEPTED SOLUTION

Accepted Solutions
Super Bronze

Re: Any Less Secure Network Rule.

As access-list is analysed top to bottom, here is what you would need to configure to achieve your requirement:

access-list permit tcp host eq

access-list deny ip

access-list permit ip any

So basically you would need to configure traffic that you would like to allow from dmz towards inside first, then ACL to deny traffic from dmz towards inside, and lastly to allow traffic from dmz to internet.

Hope that helps.

2 REPLIES
Super Bronze

Re: Any Less Secure Network Rule.

As access-list is analysed top to bottom, here is what you would need to configure to achieve your requirement:

access-list permit tcp host eq

access-list deny ip

access-list permit ip any

So basically you would need to configure traffic that you would like to allow from dmz towards inside first, then ACL to deny traffic from dmz towards inside, and lastly to allow traffic from dmz to internet.

Hope that helps.

New Member

Re: Any Less Secure Network Rule.

Hi,

That more than answers the question.  Thanks very much for the help.

David

5091
Views
5
Helpful
2
Replies