Hi,
Well it is pretty simple,
You will have to use ACL and simply only allow the traffic you need to allow. Since the ACL automatically denies any traffic that isnt specifically permitted you dont really need any deny statements even.
You cant make specific rules with the "security-level" alone and using an interface ACL basically makes the "security-level" useless for the most part.
As soon as you configure an ACL like this for example
access-list INSIDE-IN permit tcp any host 1.1.1.1 eq 80
access-group INSIDE-IN in interface inside
It will mean that only traffic that is allowed is TCP/80 traffic to destination IP address 1.1.1.1. All other traffic will be blocked because of the Implicit Deny in every ACL. It wont show in the CLI configuration. Naturally if you want you can always add the deny rule to the ACL to see the hitcount of traffic that has not matched the previous rules
access-list INSIDE-IN permit tcp any host 1.1.1.1 eq 80
access-list INSIDE-IN deny ip any any
access-group INSIDE-IN in interface inside
You will have to make sure that you dont block any essential services your users might need like usually HTTP, HTTPS, DNS for example. It really depends on what you are trying to achieve.
- Jouni
