ASA 8.2 security-level default behavior

[mbrahman@gmail.com]

Hi,

I'm trying to implement some best practices for ASA running on Software Release 8.2 and had a question about the default security-level behavior.

Let's say I have 3 interfaces...

-inside (security-level 100)

-dmz (security-level 50)

-outside (security-level 0)

I have an ACL on the inside interface allowing http access to anywhere. Because of the ACL, the implicit higher to lower security level access is nullified. Correct?

I do NOT have any ACL on the dmz interface applied. So, would the servers in the dmz be allowed outbound access to the Internet due to the default higher to lower security level behavior?

Looking forward to your responses. Thanks!

[Julio Carvajal · Accepted solution]

I have an ACL on the inside interface allowing http access to anywhere. Because of the ACL, the implicit higher to lower security level access is nullified. Correct?

That is correct, that is the whole purpose of using an ACL on the inside interface,restrict traffic.

I do NOT have any ACL on the dmz interface applied. So, would the servers in the dmz be allowed outbound access to the Internet due to the default higher to lower security level behavior?

     Yes, they will be able to access any other interface with a lower security level

Regards

[Marvin Rhoads]

In addition to Julio's correct answer, your DMZ clients would need a NAT rule to access the Internet (assuming they don't already have public IPs).

[mbrahman@gmail.com]

Thanks guys. Saved me a lotta labbing and testing!!!