Avatar of Hemil Aquino
Hemil Aquino
Flag for United States of America asked on

ASA Question?

Howdy folks,

I have a question in regards the ASA 5505. I totally understand the concept from higher to lower level, but I noticed something interesting while I was doing something at work today. Traffic from my inside could see my web server located in my DMZ via local IP address. For example source local IP (MyPC 192.168.1.50) was able to establish tcp session towards my Apache server addressed to 192.168.50.50.  I thought once you've created level of security none of them interface should communicate unless you have an access-rule such as NAT or ACCESS-LIST in placed. Please let me know if im wrong.

 Also, I have no routing nor access-list, just basic simple configuration, I just noticed it after mistakenly typed an IP address.

INSIDE 100
OUTSIDE 0
DMZ 50

Thanks you!
Hardware Firewalls* ASA5505CiscoSecurity

Avatar of undefined
Last Comment
Soulja

8/22/2022 - Mon
Soulja

By default higher level can communicate to lower security level. Once you place an ACL then that rule goes out the window. So above. INSIDE can talk to OUTSIDE and DMZ. Lower Level can't talk to higher level by default.
Hemil Aquino

ASKER
Hi Soulja,

Thank you for your reply, so it is normal that my INSIDE network can communicate with the port 80 DMZ cause higher to lower?
Other than that I cannot ping nor do anything which is fine.

My question to you is, by default does ASA send traffic from a higher level towards DMZ opening a tcp communication to connect to web server port 80?

Thank you!
ASKER CERTIFIED SOLUTION
Soulja

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy