topic Re: asa zones in Network Security

asa zones

DraganSkundric87318 — Wed, 24 Jan 2024 08:51:53 GMT

hi,

I need to implement one zone on asa withe several interfaces and no zones. I need to put two interfaces into that new zone. Will implementing this zone in any way break traffic toward other interfaces?

Re: asa zones

MHM Cisco World — Wed, 24 Jan 2024 08:57:04 GMT

Can you more elaborate

What platform you have fpr ftd ? Or asa?

Thanks

MHM

Re: asa zones

DraganSkundric87318 — Wed, 24 Jan 2024 08:58:23 GMT

asa

Re: asa zones

MHM Cisco World — Wed, 24 Jan 2024 09:07:32 GMT

As I know there is secuirty level

You can put interface in same secuirty level and permit intra and inter interface

This allow traffic between interface to pass without need acl.

If new interface have secuirty level different than old interface then sure you need acl.

MHM

Re: asa zones

DraganSkundric87318 — Wed, 24 Jan 2024 09:19:18 GMT

but traffic bwtween interfaces should flow, respecting ACL of course, regadless of zone they are mebers of? One is in the zone and others are not member of any zone?

Re: asa zones

MHM Cisco World — Wed, 24 Jan 2024 10:04:47 GMT

Friend there is no zone secuirty

If old interface in same secuirty level with new then traffic flow no need acl (need only permit intra and inter)

If the there is different in secuirty level' you need ACL.

MHM

Re: asa zones

Rob Ingram — Wed, 24 Jan 2024 09:27:54 GMT

@DraganSkundric87318 zones are only used on the ASA for ECMP (equal cost multi path) routing, you cannot not apply security controls (ACLs) based on the security zone. So normal ACL and security levels apply.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa920/configuration/general/asa-920-general-config/interface-zones.html?bookSearch=true

Re: asa zones

Aref Alsouqi — Wed, 24 Jan 2024 09:53:16 GMT

I agree with @Rob Ingram, if you are referring to the traffic zone then I would say the ASA traffic zone concept has nothting to do with some other vendors security zones concept such as Palo Alto for example. The traffic zone on the ASA could mainly be used to workaround some asymmetric routing scenarios and to allow some load balancing across multiple interfaces within a traffic zone which usually you can't do without a traffic zone. However, even with a traffic zone, the ACL and NAT for example will still be applied per interface basis, not per traffic zone basis.

Re: asa zones

MHM Cisco World — Wed, 24 Jan 2024 09:59:17 GMT

@DraganSkundric87318 dont confuse

Traffic zone is different than secuirty zone.

Traffic zone is another long story.

MHM

Re: asa zones

DraganSkundric87318 — Wed, 24 Jan 2024 10:21:44 GMT

I need to implement zone because of ECMP and just want to know if it will somehow negativelly impact existing traffic flow

Re: asa zones

MHM Cisco World — Wed, 24 Jan 2024 10:26:04 GMT

thanks for clarify

if you use Zone traffic then you need to make all interface in that traffic Zone in same security level

and then as I mention before check the security level with other interface and use ACL if needed

from cisco doc.
Security Levels

The first interface that you add to a zone determines the security level of the zone. All additional interfaces must have the same security level. To change the security level for interfaces in a zone, you must remove all but one interface, and then change the security levels, and re-add the interfaces.

Re: asa zones

DraganSkundric87318 — Tue, 30 Jan 2024 10:21:38 GMT

ok, and now .... another problem. I can create zone but cannot add interfaces to it .... I have this message on ASDM

threat detection is enabled no interface can be associated with traffic zone

and threat detection is turned off. !?!?!?

or is it not?

no threat-detection basic-threat
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept

Re: asa zones

tvotna — Tue, 30 Jan 2024 13:52:16 GMT

Basic thread-detection is disabled, but threat-detection statistics is enabled and ASDM doesn't like it. Threat-detection statistics can be quite helpful though as ASDM uses it for graphs on the firewall dashboard.

Be careful when assigning zone to an interface: this can remove static routes on the interface (CSCuu43360). This is documented: When you add an interface to a zone, all static routes for those interfaces are removed.

topic Re: asa zones in Network Security

asa zones

Re: asa zones

Re: asa zones

Re: asa zones

Re: asa zones

Re: asa zones

Re: asa zones

Re: asa zones

Re: asa zones

Re: asa zones

Re: asa zones

from cisco doc.Security Levels

Re: asa zones

Re: asa zones

from cisco doc.
Security Levels