FWSM Security Level

[estelamathew]

Hello Friends,

What i know is in ASA Higher Security level can access lower security level without an access-list but Natting is must if NAT-CONTROL is enabled

BUT in FWSM Higher Security  when it needs to access lower security level it needs access-list and Natting ???? m i correct????   And the same applies for lower security level.

Please clear my doubt.

Thanks

[mirober2 · Accepted solution]

Hello,

Yes, you are correct. The FWSM differs from the ASA in that you must permit the traffic in the inbound ACL, regardless of the security level. This is documented here:

http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/nwacc_f.html
"To allow any traffic to enter the FWSM, you must attach an inbound access list to an interface; otherwise, the FWSM automatically drops all traffic that enters that interface."

So, even for high security to low security traffic, you still must have an ACL to permit the traffic on the FWSM. Likewise, if NAT control is enabled, the traffic must also match a NAT rule (this is the same as the ASA behavior).

Hope that helps.

-Mike

[estelamathew]

Thanks Dear.