topic quick question about interface security levels in Network Security

quick question about interface security levels

nygenx2011 — Mon, 11 Mar 2019 19:30:17 GMT

as i understand

by default...any interface with a higher security leveil..i.e 100 is automatically allowed to lower..i.e 40, 0, 20

and lower is denied to higher

howerver on my asa

we have an inside interface with a security level of 100 and deviced behind that (our inside network)

trying to talk to a server in the app dmz level 20

and it is denied by the inside interface acl

only when i apply the acl to allow our inside host to talk to the dmz server will this go through..

that doesnt makes sense..shouldn't it be allowed by default even thought there is an implicit deny any rule at the end of the rule set?

Dan-Ciprian Cicioiu — Tue, 04 Jan 2011 18:58:19 GMT

nygenx2011 wrote:

and it is denied by the inside interface acl

only when i apply the acl to allow our inside host to talk to the dmz server will this go through..

that doesnt makes sense..shouldn't it be allowed by default even thought there is an implicit deny any rule at the end of the rule set?

Hi Richard,

You are right by default , the traffic from a higher sec level to a lower sec level is permited = this mean if there is no access-list applied.

If you apply the access-list , this dont cover the default behavior, and you should permit the traffic that you need to pass.

So the FW reaction is as expected.

Dan

nygenxny123 — Wed, 05 Jan 2011 16:57:04 GMT

thank you!