topic ASA and Security Levels in Network Security

ASA and Security Levels

mingram27 — Tue, 12 Mar 2019 01:21:08 GMT

Hey guys I have a very basic question, as much as I know about Firewalls. This matter escapes, can someone explain to me what does the security levels mean on the interface and could have the same security level on two different interfaces that facing the internet?

Please advise and thank you

Matt

ASA and Security Levels

julomban — Thu, 28 Mar 2013 14:17:19 GMT

Hello Matthew,

The security level protects higher security networks from lower security networks by imposing additional protection between the two.

The level controls the following behavior:

•Network access—By default, there is an implicit permit from a higher security interface to a lower security interface (outbound). Hosts on the higher security interface can access any host on a lower security interface. You can limit access by applying an access list to the interface.

Normally, interfaces on the same security level cannot communicate. If you want interfaces on the same security level to communicate, you need to add the same-security-traffic inter-interface. You might want to assign two interfaces to the same level and allow protection features to be applied equally for traffic between two interfaces; for example, you have two departments that are equally secure.

I hope it helps.

Regards,

Juan Lombana

Please rate helpful posts.

ASA and Security Levels

mingram27 — Thu, 28 Mar 2013 15:42:27 GMT

Perfect answer!!! Thank you

ASA and Security Levels

julomban — Thu, 28 Mar 2013 15:45:51 GMT

Your welcome!!!!

Please rate helpful posts.

ASA and Security Levels

James Leinweber — Fri, 29 Mar 2013 18:54:21 GMT

In practice, most interesting firewall designs end up putting access-lists on all the interfaces, at which point the security levels are moot. The primary effect of Cisco security-level concept is that an out of the box vanilla configuration with just an inside and an outside network will more or less work: the firewall will block unsolicited inbound traffic, allow outbound traffic, and allow reply packets for existing connections in.

-- Jim Leinweber, WI State Lab of Hygiene