ASA5510 access from one VLAN to another but not the other way around

[Martijn de Loos]

Hello,

Our office site has multiple VLAN subnets. Our firewall is an ASA5510. I am trying to achieve the following:

VLAN 10 may access VLAN 20's resources, such as HTTP (there are a few intranet webservers in this VLAN) but VLAN 20 may not access VLAN 10 at all. The issue I am facing right now is that I have to create an ACL on both VLAN 10 and 20 stating both networks are allowed to reach each other. If I only allow VLAN 10 to access 20 but deny VLAN 20 to 10 through an ACL, users complain they cannot reach the intranet webservers.

How can I achieve the above?

Thanks in advance.

[Hitesh Vinzoda]

Hello,

you don't need bidirectional ACL's just 10 to 20 should work.

what are the security levels of the interfaces vlan 10 and 20?

Thanks

Hitesh

[Martijn de Loos]

Hi Hitesh,

Both VLANs are security-level 50.

[Hitesh Vinzoda]

Thats why you need ACL's both ways.

can you change the security level of VLAN20 to 49 ? and try.

If this is a production network and any other dependent configuration, you may want to consider the dependency and then change the config.

HTH

Hitesh