The Security Level of two direct connected interfaces of two firewalls

[Tang-Suan Tan]

Hi all :

I have one doubt needs to be clerify :

If one interface for example with name of edgeA of firewall A directly connects to another interface of firewall B with the name edgeB, does these two interfaces of two firewalls need to be at the same security level?

For example the security level of edgeA is 50 at firewall A, is it necessary to set the security level of edgeB to 50 at firewall B?

thanks and best regards,

tangsuan

[varrao]

Hi Tang,

No it is not necessary to keep them on the same security level, you can assign them different. But if you assign diff levels, then for lower security interface to access users in higher security interface, you would need to allow the traffic in the ACL. If you keep them same security, then you don't need any acl, just the command "same-security-traffic permit inter-interafce", and this would allow the traffic.

Hope this helps.

Thanks,
Varun Rao
Security Team,
Cisco TAC

[Tang-Suan Tan]

Hi Varun :

Thanks to your answer.

One thing still not clear is these two interfaces are in the same subnet since they are in the same LAN line. They are in two different interfaces due to two different firewalls.

If setting to different security level, how to set the access rule because :

1. They are in the same subnet.Firewall access rule normally is set to work in different subnet in router mode.These two firewalls are in router mode now.

2. They are in different firewall. How to set the access rule since one IP of the interface in firewall A and another in firewall B? Both firewall have to set the rule or only one of them has to set the rule?

As such, it seems like to set in different security level is impossible. Can you clarify? Thanks!

best regards,

tangsuan

[varrao]

Hi,

I am not sure about your topology, can you shatre it with me. If the subnets are behind two different firewalls then it really doesn't matter what security level you assign them. They would communicate irrespective of the security level assigned to them. Maybe it can be more clear if you can explain with the help of a topology.

Thanks,
Varun Rao
Security Team,
Cisco TAC

[Tang-Suan Tan]

Hi Varun and all :

The topology is as below simple diagram. Please help to clarify the same security is needed and if in the event of different security level, how to set the access rules and other configurations. Many thanks!

Thanks and best regards,

tangsuan

[hobbe · Accepted solution]

Hi Tangsuan

Since the firewalls are different units the security level does not have to be the same.

Security level is an INTERNAL firewall calculation on how traffic to/from interfaces should behave towards eachother, it is not something that is shared between firewalls.

There is no way for firewall A to know the security level of interface B in firewall B.

so there is no impact whatsoever in what security level firewall A is using towards firewall B or vice verse.

So to clarify Firewall A can have any security level in interface A and firewall B can have any security level in interface B

You handle the traffic just the same as you would any traffic on any interface. fx with Access-lists.

Good luck

HTH

[Tang-Suan Tan]

Hi Hobbe / Varun  :

Thanks to all your replies!

I am glad to have the good answer from Hobbe. It has cleared my doubt.

regards,

tangsuan