topic Re: ASA 9.1 code enable traffic between interfaces with same sec in Network Security

ASA 9.1 code enable traffic between interfaces with same security levels

Scott Robertson — Tue, 12 Mar 2019 02:01:04 GMT

Asa 5525x with 9.1 code with multicontext
Mode enabled

I enabled traffic between interfaces with same security level on admin firewall context . This works but when I disable this feature and apply inbound ACLs to these same interfaces log indicates packets are being denied by implicit policy even though my acl permits this traffic
Any clues to why this occurs ? Tried rebooting Asa after disabling same interface security level traffic to no avail.

Thanks Team

Scott

Re: ASA 9.1 code enable traffic between interfaces with same sec

Jouni Forss — Thu, 20 Jun 2013 15:49:43 GMT

Hi,

If you have interfaces configured with same "security-level" value then the only way traffic can pass between them is if you have "same-security-traffic permit inter-interface" configuration enabled.

So even if you allow traffic with "access-list" configurations on the interfaces BUT you dont have the above configuration command enabled then traffic will still get blocked.

So you either have to configure "same-security-traffic permit inter-interface" OR you will have to change either interfaces "security-level" so they dont match.

- Jouni

Re: ASA 9.1 code enable traffic between interfaces with same sec

Scott Robertson — Thu, 20 Jun 2013 16:14:43 GMT

So can/will Acl's control traffic on these interfaces with the same security level feature enabled and interfaces configured at same level or will all traffic be permitted regardless of ACL's if security levels are equal?

Thank you!

Sent from Cisco Technical Support iPhone App

Re: ASA 9.1 code enable traffic between interfaces with same sec

Jouni Forss — Thu, 20 Jun 2013 16:21:58 GMT

Hi,

If you have "same-security-traffic permit inter-interface" configured and have 2 interfaces with same "security-level" value and you have "access-list" configured on both interfaces then the ACLs will handle the decision of what traffic is allowed and what is not.

In the above case you could consider the "same-security-traffic permit inter-interface" a kind of command that overcomes a default limitation of communication between interfaces with same "security-level" interfaces.

So basically when you have interface ACLs configured then they will decide which traffic is allowed even if you have the "same-security-traffic" configurations enabled

Hope this helps

Please do remember to mark the reply as the correct answer if it answered your question.

Or ask more if needed.

- Jouni

Re: ASA 9.1 code enable traffic between interfaces with same sec

Scott Robertson — Fri, 21 Jun 2013 13:23:54 GMT

Thank you Jouni !

I understand the logic at this point and appreciate your qucik responses.

Re: ASA 9.1 code enable traffic between interfaces with same sec

Ni2 — Thu, 28 Feb 2019 02:30:04 GMT

Re: ASA 9.1 code enable traffic between interfaces with same sec

drlbaluyut — Thu, 28 Feb 2019 02:43:21 GMT

Re: ASA 9.1 code enable traffic between interfaces with same sec

Mohammed al Baqari — Thu, 28 Feb 2019 03:21:26 GMT

It can be applied globally only.