https://community.cisco.com/t5/network-security/asa-5525-how-many-different-acls-need-entries-for-this-circuit/m-p/4782277#M1098151 <P><a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1443661">@MicJameson1</a> if server1 in the dmz initiates communications, then there would need to be one ACL to permit the traffic, with at least 1 ACE. As the ASA is stateful, the return traffic would automatically be permitted. Meaning you don't need to explicitly permit the return traffic.</P> <P>Interfaces with a lower security level (DMZ) communicating with interfaces with a higher security level (inside) need an ACL to explictly permit traffic. Interfaces with a higher security level communicating with a lower security level do not need an ACL to permit traffic and is permitted as default.</P> Fri, 24 Feb 2023 20:20:16 GMT Rob Ingram 2023-02-24T20:20:16Z https://community.cisco.com/t5/network-security/asa-5525-how-many-different-acls-need-entries-for-this-circuit/m-p/4782274#M1098150 <P>SERVER1 (security zone 50 of dmz) ==&gt;&nbsp; ASA-5525 ==&gt; inside network (security zone 100) ==&gt; ISR-router ===&gt; www SERVER2</P><P>Server1 initiates the connection to server2. Obviously there is return traffic to Server1.</P><P><STRONG>Regarding only ASA-5525, how many different ACLs need entries for these servers to communicate in this instance?</STRONG></P><P>Thank you.</P> Fri, 24 Feb 2023 20:05:58 GMT https://community.cisco.com/t5/network-security/asa-5525-how-many-different-acls-need-entries-for-this-circuit/m-p/4782274#M1098150 MicJameson1 2023-02-24T20:05:58Z https://community.cisco.com/t5/network-security/asa-5525-how-many-different-acls-need-entries-for-this-circuit/m-p/4782277#M1098151 <P><a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1443661">@MicJameson1</a> if server1 in the dmz initiates communications, then there would need to be one ACL to permit the traffic, with at least 1 ACE. As the ASA is stateful, the return traffic would automatically be permitted. Meaning you don't need to explicitly permit the return traffic.</P> <P>Interfaces with a lower security level (DMZ) communicating with interfaces with a higher security level (inside) need an ACL to explictly permit traffic. Interfaces with a higher security level communicating with a lower security level do not need an ACL to permit traffic and is permitted as default.</P> Fri, 24 Feb 2023 20:20:16 GMT https://community.cisco.com/t5/network-security/asa-5525-how-many-different-acls-need-entries-for-this-circuit/m-p/4782277#M1098151 Rob Ingram 2023-02-24T20:20:16Z