topic ACL and default traffic flow from higher to lower interface ques in Network Security

ACL and default traffic flow from higher to lower interface question

Alan Herriman — Mon, 11 Mar 2019 23:07:31 GMT

Hello all,

This may be a fairly simple question to answer, but I did some searching and couldn't find a good answer. By default ASA's will allow traffic from a high security interface to a lower secuirt interface. Such as the inside(100) to outside(0) and dmz(50) or dmz to outside(0). If you apply an ACL incoming on that interface is the higher to lower interface behavior still present? I want to do some egrees filtering on my dmz interface, but still want it to be able to access the outside network. I want to block my inside interface from being able to access my DMZ at all. Any good suggestions on how to do this?

Thanks in advance!

ACL and default traffic flow from higher to lower interface ques

lcambron — Tue, 15 May 2012 18:14:58 GMT

Alan,

The ACL bypasses the high to lower rule.

If you want to block access from inside to DMZ, you can change security level on DMZ to 100.

Or if you want to use ACL.

int g0/1

nameif inside

ip addresses 192.168.1.0 255.255.255.0

int g0/2

nameif dmz

ip address 172.16.0.0 255.255.255.0

access-list name deny ip 192.168.1.0 255.255.255.0 172.16.0.0 255.255.255.0

access-list name permit ip any any

access-group name in interface inside

hope this helps,

Felipe.

ACL and default traffic flow from higher to lower interface ques

Alan Herriman — Tue, 15 May 2012 19:09:09 GMT

Hey Felipe,

That does help, but I need clafication on one part. Does the Access-list work along side the default behavior to allow traffic from a higher security interface to a lower secuirty interface or does it replaces that behavior?

Thanks,

Alan

ACL and default traffic flow from higher to lower interface ques

lcambron — Tue, 15 May 2012 19:38:41 GMT

Alan,

The ACL replaces the security levels, however the ASA also needs NAT for traffic between interfaces.

Example; source IP needs to be NAT'ed from high to lower security level, so even with ACL the security level still matters for NAT.

This is only until version 8.2

Felipe.

ACL and default traffic flow from higher to lower interface ques

Alan Herriman — Tue, 15 May 2012 19:56:39 GMT

Ok thanks for the info!

An example of this would be if my inside interface was 192.168.1.0 and my dmz was 192.168.2.0. I would need a statement like this? static (inside,dmz) 192.168.2.0 192.168.1.0 255.255.255.0

Best Regards,

Alan

ACL and default traffic flow from higher to lower interface ques

lcambron — Tue, 15 May 2012 21:15:37 GMT

Alan,

You can do:

nat (inside) 1 192.168.1.0 255.255.255.0

global (dmz) 1 interface

static (inside,dmz) 192.168.1.0 192.168.1.0

Felipe.