topic Any Less Secure Network Rule. in Network Security

Any Less Secure Network Rule.

David Shearing — Mon, 11 Mar 2019 18:43:17 GMT

Hi,

Im a little confused about the logic of this rule on the ASA 5510, basically i have the following interfaces set to the following security levels:

Inside: 100

DMZ: 4

Outside: 0

The DMZ has a rule by default which allows any traffic to a less secure network, but when i add a rule on that interface so that the dmz can push limited traffic to the inside network for our exchange server it disapears. Does this mean that now that rule has gone if i want that interface to have internet access via the outside interface i have to add a rule in? or will it still allow traffic to lower interfaces? if not is there anyway to add the rule back in and have additional rules on an interface to a higher security interface?

Hope that makes sense.

Thanks in advance for the help

David

Re: Any Less Secure Network Rule.

Jennifer Halim — Wed, 22 Sep 2010 07:13:40 GMT

As access-list is analysed top to bottom, here is what you would need to configure to achieve your requirement:

access-list permit tcp host eq

access-list deny ip

access-list permit ip any

So basically you would need to configure traffic that you would like to allow from dmz towards inside first, then ACL to deny traffic from dmz towards inside, and lastly to allow traffic from dmz to internet.

Hope that helps.

Re: Any Less Secure Network Rule.

David Shearing — Wed, 22 Sep 2010 10:24:48 GMT

Hi,

That more than answers the question. Thanks very much for the help.

David