Hi,
Problem comes when you want to start doing more than the default firewalling and you add an ACL to create an exception, just for testing purposes I created an ACL from inside to dmz to allow icmp packets, by the implicit deny everything else will be discarted. My surprise is that once you create an ACL the inspection is not working anymore, and even not having icmp protocol inspected in the policy rule, ping is allowed whereas with the original config, ping is denied if is not inspected.
To my understanding by default ICMP will fail in the situation where you only have "security-level" in use OR you have an ACL allowing ICMP from the LAN to the WAN. To my understanding in either previously mentioned cases you need ICMP inspection to enable the Echo Reply messages to get through the firewall. Otherwise you have to allow ICMP Echo-reply on the WAN interface ACL of the ASA. So to me the ACL doesnt disable the inspection even if you allow the ICMP traffic on the ACL of the LAN interface.
Its been my understanding that the "security-level" value plays a role in simple network implementations but is not really used in any more complex setups as its logic simply isnt enough to meet the needs of those.
But at some point you are still going to want to limit some connections that should go through the firewall. For example limit SMTP, DNS, FTP, HTTP, Backup traffic, etc to certain destination services and that is when you need ACLs to control the traffic.
Going only with the "security-level" you are really limited to access rules that work with the logic "Allow everything or Deny everything" which isnt really usefull in the environments that I manage for example.
Using the ACL on the interface doesnt to my understanding mean that ASA will simply forget the state of the connections. For example for TCP connections it should still expect the TCP negotiation to go through the normal steps. It also expects that if traffic comes to the firewall which is supposedly part of an existing connection THAT the ASA indeed has the information of that connection in its connection/xlate table or it will simply block this traffic. To my understanding a simple Router wont care about this (though there is the "established" parameter)
I am not sure about the history if the "security-level". But to be honest for me it doesnt mean much when configuring the firewall. Most of the time it seems to be the cause of a problem for some users that dont know how the different interfaces with varying "security-level" handle traffic between them. You will still need other condifurations to allow traffic to enter and leave the same interface and also traffic to go through if the source/destination interfaces have equal "security-level"
- Jouni
