1

I try to understand how to combinate implicit global ACL witch security level.

1) In documentation there are: Traffic from Higher Security Level to Lower Security Level: Allow ALL traffic originating from the higher Security Level unless specifically restricted by an Access Control List (ACL).

2) But in Cisco ASA, there is implicit default global access rule. Deny any any on all interface for incoming traffic.

Point 1) and 2) are in contradiction.

Can anybody explain it? Thank you.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 9:19

1 Answer 1

Reset to default
2

1 and 2 are not in contradiction. 1 states that is the behavior unless you have an EXPLICIT ACL entry, while 2 states that there is an IMPLICIT deny (which would catch everything else not filtered by your explicit statements).

Explicit means it was manually added (by you); implicit means it is a default action (essentially).

When you initially define interfaces, the outside interface is automatically given a security level of 0 while the inside interface is automatically given a security level of 100. This accounts for the higher-to-lower behavior you saw. The inverse (lower-to-higher) would be blocked by default and would require having a NAT or PAT as well as rules to allow the traffic coming in.

Improve this answer
6
  • Sorry, I don´t understand. I have pure installation ASA with two interface: inside (SL = 100) and outside (SL = 0). I don´t have explicit access rule. Everything is default. By item 1) I should be able to ping from inside to outside (for example 8.8.8.8). But implicit global access rule block my ping from inside to outside. Why exist security levels when implicit global access rule block my ping.
    – kocak
    Aug 23, 2018 at 12:31
  • Security levels are there to make sure that zones deemed to be more secure (such as a LAN) are not automatically accessible (without a rule) to zones which may have more exposure to the internet. For example, if you take a web-server and DB server as an example, with the web-server in the DMZ and DB server on the inside, you would want your DB to be able to talk with the web server fairly freely but have limited access (probably just standard SQL ports, for example) FROM the web server in case it was breached to limit the amount of access to the rest of your network.
    – Jesse P.
    Aug 23, 2018 at 12:41
  • You don't HAVE to have different security levels, either. You can set them all to the same level and unless you also have "same-security-traffic permit inter-interface" defined globally, you'd still need to specify what to allow between interfaces. WITH that command, all traffic would be able to flow without restriction between your interfaces if they are setting the same security level (unless you block something using ACLs).
    – Jesse P.
    Aug 23, 2018 at 12:44
  • If your ASA is still at all of its defaults, there is possibly a different reason your pings aren't working. You might be missing a NAT or your default route. If you can post your full config I can help figure out what you're missing.
    – Jesse P.
    Aug 23, 2018 at 12:52
  • 1
    Also the 'gotcha' for ping is that you must add ICMP to the default inspection policy, otherwise the ASA won't treat is as stateful. Ergo, return traffic isn't associated with the origin traffic, and isn't permitted. Here's what you need: cisco.com/c/en/us/support/docs/security/…
    – boomi
    Aug 23, 2018 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.