Hello Francesco,
thank you, I already know about this option, we use it in several of our smaller Cisco ASA clusters but it seems not to be a practical solution on our shared customer hosting firewall because imagine we have 200 customers and 50 global rules (for communication over the OUTSIDE interface) and when I now insert a deny rule on the end of every interface's incoming policy and activate the inter-interface feature then I'm disabling the 50 global rules and it would require me to duplicate the 50 rules 200 times resulting in 1000 policy rules instead of 50 policy rules
when I then want to do a modification in one of the "global" rules then I cannot do one change but I need to do 200 changes, right?
the ideal solution for us would be when there would exists an address element definition for "ANY INSIDE", in this case I could say in my final deny rule on every inside interface: deny any inside traffic but not deny traffic passing the outside interface
if there is no better already implemented solution from Cisco then I will maintain an address element group with all inside networks to achieve the required behaviour
Best regards
Thomas
