ASA Behavior Access lists

[rakeshvelagala]

Hi All,

From What I have learnt regarding access lists, if there is a global access list, it will be checked after checking the interface access list and the "deny ip any any" will be at the end of global access list instead of at the interface.

Question

When we have Global access list, the implicit rule that permits all IP traffic from high security level(say 100) to low security level(say 0) will be disabled?

Kindly advise

Thanks & Regards

[Marius Gunnerud]

If you use the global access list only, you would need to configure rules in both directions:

access-list test extended permit ip host 1.1.1.2 host 2.2.2.1
access-list test extended permit ip host 2.2.2.1 host 1.1.1.2

access-group test global

So yes, the security levels will be disabled.

--

Please remember to select a correct answer and rate helpful posts