Solved

security levels and Vlans

Posted on 2014-12-11
4
66 Views
Last Modified: 2015-03-13
We have a number of Vlans with different security levels.  When all the Vlans are set with the same security level on our ASA 5545, the Vlans can communicate.

When i change the Vlans to different security levels, they cannot communicate.  

Is there a command i can use to enable this?
0
Comment
Question by:beckredder
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 29

Accepted Solution

by:
Jan Springer earned 500 total points
ID: 40494883
Yes, you need to create an access list for the higher vlan which allows traffic to the lower vlan.

access-list dmz extended permit tcp 192.168.1.0 255.255.255.0 host 172.16.31.43 range 1433 1434

where dmz has subnet 192.168.1.0/24 and has a security level higher than 172.16.31.43.
0
 

Author Comment

by:beckredder
ID: 40494984
without any rules other than the implicit deny for interfaces accessing higher from lower shouldn't hosts in the higher vlan be able to access hosts in the lower vlan?

I add a rule between the two hosts allowing access from the lower to the higher and I then can ping both ways.  Remove the rule and I cannot ping.

How do I configure it so that only the higher vlan is able to ping the lower vlan?

Its like ICMP traffic isn't allowed to make the round trip without the rule in place.
0
 
LVL 29

Expert Comment

by:Jan Springer
ID: 40495019
oh gosh, yes, I had that backwards.  what does packet-tracer show?

packet-tracer input ZONE PROTO ORIGIN_IP 65535 DEST_IP DEST_PORT

i.e.,

packet-tracer input inside tcp 172.16.31.43 65535 192.168.1.34 eq 1433 detail
0
 

Author Comment

by:beckredder
ID: 40663197
I've requested that this question be deleted for the following reason:

wrong question
0

Featured Post

Ready to get started with anonymous questions?

It's easy! Check out this step-by-step guide for asking an anonymous question on Experts Exchange.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses
Course of the Month9 days, 3 hours left to enroll

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question