Security levels on ASA

[Andy White]

Hello,

I'm trying to allow traffic between 2 VLAN's/sub interfaces on my ASA, the both have their security Level set at 25.  At the moment I can't even ping devices between the 2 and my access lists are wide open.  I raised one of the security groups to 35 and everything seem to work.

I'm left a little confused, if security levels are the same are the untrusted?  What ever I did on the access list side (to open it up) seemed to be ignored.

[johnbroadway]

hi,

have you tried enabling the same level intra-interface communications. Here's a link all about it:

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml

hostname(config)# same-security-traffic permit inter-interface

regards

John

[Andy White]

Thanks John,

Is this commonly enable by most, I set both these sub interfaces to the same as they sort of need resources from each, have the same security set like you mention is a good idea in my eyes.

[johnbroadway]

It is a fairly new option (I think since V7 ish) for your sort of instance.

If both interfaces require resources from the other then it seems a reasonable approach to me.

John