Any Less Secure Network Rule.

[David Shearing]

Hi,

Im a little confused about the logic of this rule on the ASA 5510, basically i have the following interfaces set to the following security levels:

Inside: 100

DMZ: 4

Outside: 0

The DMZ has a rule by default which allows any traffic to a less secure network, but when i add a rule on that interface so that the dmz can push limited traffic to the inside network for our exchange server it disapears.  Does this mean that now that rule has gone if i want that interface to have internet access via the outside interface i have to add a rule in?  or will it still allow traffic to lower interfaces?  if not is there anyway to add the rule back in and have additional rules on an interface to a higher security interface?

Hope that makes sense.

Thanks in advance for the help

David

[Jennifer Halim · Accepted solution]

As access-list is analysed top to bottom, here is what you would need to configure to achieve your requirement:

access-list permit tcp host eq

access-list deny ip

access-list permit ip any

So basically you would need to configure traffic that you would like to allow from dmz towards inside first, then ACL to deny traffic from dmz towards inside, and lastly to allow traffic from dmz to internet.

Hope that helps.

[David Shearing]

Hi,

That more than answers the question.  Thanks very much for the help.

David