if i put security 100 on inside and dmz, do i still need ACL?

[Neetu Bhushan]

hi all,

since i'm new to asa...  and my current network don't have acl in between router 3750x and switch 2960s.  if i put security 100 on both dmz and inside network, do i still need ACL in between them?  i basically want for now everything working and especially turn on the jumbo frame on my dmz network since most of my server are in vsphere 5.0.

of course, i will hardened the security later.

thanks for any comment you may add.

[Jouni Forss · Accepted solution]

Hi,

You will have to configure this configuration on the ASA IF the interfaces have identical "security-level" values and DONT have ACLs and you want traffic to flow freely between them.

same-security-traffic permit inter-interface

Here is a link to one ASA Command Reference that explains the command better

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s1.html#wp1421315

- Jouni

[Neetu Bhushan]

one more question?

the  same-security-traffic permit intra-interface is for VPN network, right?

[Jouni Forss]

Hi,

The most common use for the command you mention is for VPN traffic.

In general it enables traffic to flow so that it can enter an ASA interface and leave out through the same interface. For example when a VPN Client connects to a host that is behind a L2L VPN connection.

- Jouni