topic You only need the first rule. in Network Security

Basic rule question on ASA

louis0001 — Tue, 12 Mar 2019 08:05:04 GMT

Very basic question on firewall rules on the ASA.

I have 2 interfaces. Lets call them LAN 1 & LAN 2. Both have the same security level.

HOST A on LAN 1 should communicate with HOST B on LAN 2 on http only

So the rule for LAN 1 interface is:

Source: HOST A
Destination: HOST B (LAN 2)
Port: 80/tcp

Do I then need to put a rule in LAN 2 interface like so:

Source: HOST A (LAN 1)
Destination: HOST B
Port: 80/tcp

You only need the first rule.

Philip D'Ath — Tue, 02 Aug 2016 20:40:03 GMT

You only need the first rule. The return traffic will be allowed automatically.

You will need the config "same-security-traffic permit inter-interface".

Lets assume the LAN 2

louis0001 — Tue, 02 Aug 2016 20:57:58 GMT

Lets assume the LAN 2 interface (sec level 100) has a higher security level then LAN 1 (sec level 90)

I know a higher level can access a lower security level but if I want the traffic to be restricted so HOST B can only respond to HOST A, would I need the 2nd rule?