Dear Board,   we're using multiple subinterfaces on ASA for multiple VLANs. When configuring on one interface a "permit any any http" this means traffic can not only go to the public internet but also to other VLAN subinterfaces on http when there is no explicit deny any 10.0.0.0/8 http before it and given the fact, the interfaces do not use the same security level. But that makes it pretty confusing and not "pretty" when having a deny rule before a permit any.   I was thinking about a group-object excluding RFC1918 (0.0.0.0-9.255.255.255, 11.0.0.0-172.15.255.255, 172.32.0.0-192.167.255.255, 192.169.0.0-223.255.255.255) and use it instead of "any".   Other idea was to use the same security level for all interfaces on ASA as traffic between same-security is not allowed.   Any other ideas or suggestions to avoid having "any" or using "any" but without enabling access to other networks.   Thanks!     ... View more

Hi, i'm trying to configure some ip access-lists on a WAAS but it seems that it's not matching the traffic. interface InlineGroup 1/0 inline vlan all ip access-group test in exit ip access-list extended test deny icmp any any exit Im still able to ping wherever i want. Any ideas? Or is it not possible to handle traffic with ACLs like that on WAAS? Thanks, Markus ... View more