Saturday, May 30, 2015

Security Levels in Cisco ASA

ASA Security Levels are used to define how traffic initiated from one interface is processed. When configuring an ASA with no access-list applied on any of the interface, no access lists are required for traffic from a high security level interface to go through a low security level interface, but the other way around low security level to higher security level is not possible unless we configure an access-list that permits this traffic.

The higher the security level, the more trusted the interface is. Each interface on the ASA is a security zone so by using these security levels we have different trust levels for our security zones.

User can manually assign security level for an interface with the command “security-level <level>”

Here are a couple of examples of security levels:

•  Security level 0: This is the lowest security level on the ASA and by default it is assigned to the “outside” interface. Since there is no lower security level this means that traffic from the outside is unable to reach any of our interfaces unless we permit it within an access-list.

•  Security level 100: This is the highest security level on our ASA and by default this is assigned to the “inside” interface (LAN). Since this is the highest security level, by default it can reach all the other interfaces.

•  Security level 1 – 99: We can create any other security levels that we want, for example we can use security level 50 for our DMZ. This means that traffic is allowed from our inside network to the DMZ (security level 100 -> 50) and also from the DMZ to the outside (security level 50 -> 0). Traffic from the DMZ however can’t go to the inside (without an access-list) because traffic from security level 50 is not allowed to reach security level 100. You can create as many security levels as you want…

•  Same Security level: Traffic between interfaces with the same security level is not allowed. For example, if you have an interface called “DMZ1” with security level 50 and another one called “DMZ2” with the same security level 50 then traffic between the two will be dropped. You can change this behavior with the global command "same-security-traffic permit inter-interface".







Leave your comment below


34 comments:

  1. It’s very informative and you are obviously very knowledgeable in this area. You have opened my eyes to varying views on this topic with interesting and solid content. security company

    ReplyDelete
  2. Your content is very impressive and thanks for sharing this article. it’s very useful.
    Really this is a very useful blog.
    servicenow demo

    ReplyDelete
  3. I really enjoy reading and also appreciate your work. private security

    ReplyDelete
  4. I am continually amazed by the amount of information available on this subject. What you presented was well researched and well worded in order to get your stand on this across to all your readers. buy real instagram likes famoid

    ReplyDelete
  5. It is very simple to get the value cites for the administrations offered by the security watches through different sites. Construction site security

    ReplyDelete
  6. One improvement prompts another and he never just stops and headway and progress in endless and is an on going task.cyber security in hyderabad

    ReplyDelete
  7. In today's fast-paced world there seems to be some newfangled security gadget or 24response software coming out almost daily. I have been around long enough to become accustomed to scanners that read vehicle license plates.

    ReplyDelete
  8. Very efficiently written information. It will be beneficial to anybody who utilizes it, including me. Keep up the good work. For sure i will check out more posts. This site seems to get a good amount of visitors. ip cameras

    ReplyDelete
  9. The most interesting text on this interesting topic that can be found on the net ... Sincerly René

    ReplyDelete
  10. We have sell some products of different custom boxes.it is very useful and very low price please visits this site thanks and please share this post with your friends. https://security-company001.weebly.com/

    ReplyDelete
  11. I think this is an informative post and it is very useful and knowledgeable. therefore, I would like to thank you for the efforts you have made in writing this article. https://best-seo-singapore.blogspot.com/2021/09/take-look-at-pinnacle-security-firms-in.html

    ReplyDelete
  12. Someone who has completed and passed CCNA training will have the knowledge to set up all manner of home and business networks. CCNA Classes in Pune

    ReplyDelete
  13. This is my first visit to your web journal! We are a group of volunteers and new activities in the same specialty. Website gave us helpful data to work. Security services Company to hire

    ReplyDelete
  14. Awesome article! I want people to know just how good this information is in your article. It’s interesting, compelling content. Your views are much like my own concerning this subject. https://www.tumblr.com/blog/securitycompany11

    ReplyDelete
  15. An interesting dialogue is price comment. I feel that it is best to write more on this matter, it may not be a taboo topic however usually individuals are not enough to talk on such topics. To the next. Cheers. cambodia security company

    ReplyDelete
  16. I can see that you are an expert at your field! I am launching a website soon, and your information will be very useful for me.. Thanks for all your help and wishing you all the success in your business. security company in cambodia

    ReplyDelete
  17. Interesting post. I Have Been wondering about this issue, so thanks for posting. Pretty cool post.It 's really very nice and Useful post.Thanks https://www.tumblr.com/blog/princesecurityservice1212

    ReplyDelete
  18. Thanks for the blog loaded with so many information. Stopping by your blog helped me to get what I was looking for. best security company in cambodia

    ReplyDelete
  19. very interesting post.this is my first time visit here.i found so mmany interesting stuff in your blog especially its discussion..thanks for the post! security service in cambodia

    ReplyDelete
  20. Very good points you wrote here..Great stuff...I think you've made some truly interesting points.Keep up the good work. Serious Security CCTV Sydney

    ReplyDelete
  21. I was surfing the Internet for information and came across your blog. I am impressed by the information you have on this blog. It shows how well you understand this subject. https://penzu.com/p/e3908632

    ReplyDelete
  22. You make so many great points here that I read your article a couple of times. Your views are in accordance with my own for the most part. This is great content for your readers. https://terazajuan.wixsite.com/my-site-1/post/security-company-in-cambodia

    ReplyDelete
  23. Interesting post. I Have Been wondering about this issue, so thanks for posting. Pretty cool post.It 's really very nice and Useful post.Thanks private security company

    ReplyDelete
  24. I like your post. It is good to see you verbalize from the heart and clarity on this important subject can be easily observed... https://penzu.com/p/2adfc0e9

    ReplyDelete
  25. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I'll be subscribing to your feed and I hope you post again soon. Big thanks for the useful info. cambodian security company requirements

    ReplyDelete
  26. Only strive to mention one's content can be as incredible. This clarity with your post is superb! Thanks a lot, hundreds of along with you should go on the pleasurable get the job done. security services company in phnom penh

    ReplyDelete
  27. Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work. http://service381.website2.me/

    ReplyDelete
  28. this is really nice to read..informative post is very good to read..thanks a lot! check price of surveillance system

    ReplyDelete
  29. I think this is an informative post and it is very useful and knowledgeable. therefore, I would like to thank you for the efforts you have made in writing this article. security guard

    ReplyDelete
  30. A big thank you for your article post. Much thanks again. Will read on...
    safe deposit box at best price

    ReplyDelete