Restrict communication between two interfaces on ASA

[Yashveer Singh]

Hi, I have configured 3 interfaces of ASA.  inside, outside and WiFi. Where I have given full internet access to WiFi subnet by allow destination any. WiFi vlan is routable vlan bcoz to access WiFi portal through WiFi subnet. Now to playing with right manner, I have to stop communication between inside and WiFi interface and full internet should be accessible. Please assist me. What policies i need to create on firewall for same.

[Marvin Rhoads]

Thee interfaces each get unique security level:

Inside 100

Wi-fi 50

Outside 0

By default Inside can communicate to any lower security level i.e., wi-fi and outside.To prevent this, create and apply to acl to inside interface:

access-list inside_access_in extended deny ip any4 <wi-fi network>
access-list inside_access_in extended permit ip any4 any4
access-group inside_access_in in interface inside