Design question: Intra-site traffic and to Internet

[hoffa2000]

Hi everyone

I'm stuck on a design issue with an ASA 5512-x 9.3 and neither Google or the Cisco documentation offer any suggestions.

What I'm trying to accomplish is allow certain ports from the client network to the server networks. Since this site is also connected to another site over VPN I've set up a few global rules to allow some services to pass over VPN, sysopt connection permit-vpn is not enabled. The client network has security level 90 and the server network has 100, Internet 0. So far so good, VPN is up and the global services are working. When I add an access list to the client interface allowing my services to the server network I also get connectivity to the servers.

It is when I try to set up access to the Internet I get confused. How can I set up an all-services rule from the client network to the Internet without at the same time allowing all-services to the server network? My only thought is to allow the client-to-server ports and then a deny rule followed by an allow IP to any for the Internet. I don't know, I'd rather avoid having to mix allow and deny.

Regards

Fredrik

[Jon Marshall]

Frederik

I don't know, I'd rather avoid having to mix allow and deny.

A lot of acls often follow this pattern if there is internet traffic involved.

In fact if all you wanted to do is permit any traffic from the clients to the internet you wouldn't even need an acl because it would be allowed by default due to the security levels.

I'm not sure what the issue is ?

Jon

[hoffa2000]

Hi Jon

You're correct, the implicit rule permits my traffic to Internet but as soon as I add a rule for the server net services the implicit rule is removed and has to be added manually.

It's been a while since I worked with ASAs and I was sort of hoping there was a nice way around this without having to add denies in the ACL.

/Fredrik

[Jon Marshall]

Frederik

I think you missed my point.

If you want to allow everything you don't need an acl.

If you want to allow some traffic but not other traffic then you need an acl.

That is the whole point of an acl ie if all you ever wanted to do was permit traffic you would never need acls unless the security levels dictated it.

Jon