The Cisco ASA Firewall uses so called “security levels” that indicate how trusted an interface is compared to another interface. The higher the security level, the more trusted the interface is. Each interface on the ASA is a security zone so by using these security levels we have different trust levels for our security zones.An interface with a high security level can access an interface with a low security level but the other way around is not possible unless we configure an access-list that permits this traffic.Here are a couple of examples of security levels:. Security level 0: This is the lowest security level there is on the ASA and by default it is assigned to the “outside” interface. Since there is no lower security level this means that traffic from the outside is unable to reach any of our interfaces unless we permit it within an access-list. Security level 100: This is the highest security level on our ASA and by default this is assigned to the “inside” interface. Normally we use this for our “LAN”.
Since this is the highest security level, by default it can reach all the other interfaces. Security level 1 – 99: We can create any other security levels that we want, for example we can use security level 50 for our DMZ. This means that traffic is allowed from our inside network to the DMZ (security level 100 - 50) and also from the DMZ to the outside (security level 50 - 0). Traffic from the DMZ however can’t go to the inside (without an access-list) because traffic from security level 50 is not allowed to reach security level 100. You can create as many security levels as you wantLet’s take a look at a Cisco ASA firewall with three interfaces so you can see this behavior in action, here’s the topology I will use:Above you see the Cisco ASA in the middle with three interfaces:. Interface E0/0 as the INSIDE. Interface E0/1 as the OUTSIDE.
Interface E0/2 as our DMZ.I will use the routers so we can generate some traffic between the different security levels. By default the ASA has a global inspection policy (that we’ll discuss in another lesson) that doesn’t permit ICMP traffic. If you want to ping between devices through your ASA firewall then we have to inspect ICMP traffic, you can do it like this: ASA1(config)# policy-map globalpolicyASA1(config-pmap)# class inspectiondefaultASA1(config-pmap-c)# inspect icmpNow ICMP traffic will be allowed between different interfaces. Traffic from InsideLet’s send some pings from R1 to R2 (outside) and R3 (DMZ). Hi Donald,In this example, I only used the routers so that I would have some devices to ping with/to. I also could have used computers but routers are easier since you can access them through the CLI and you don’t have to worry about firewalls blocking ICMP traffic.Sometimes, it can be useful to have a router in front of the ASA.
As a firewall, the ASA does a great job at packet filtering / VPNs but it’s a poor router. If you want to use specific features (like policy based routing) then using a router in front of the ASA works very well.
If you don’t need an. Hi,quick question regarding the service policy placement on the ASA, not including global because that’s pretty self explanatory. I created just a simple topology where the ASA was in the middle and has 2 routers on either side, the outside interface had a security level of 0 and inside 100, the outside interface is also blocking all traffic coming in. I implemented NAT on the ASA as well to change the inside network IP’s to the outside interface.My policy map inspects ICMP and i applied it to a service policy that was placed on the inside interface, i tested. Hi, Thanks From Post,i have Done Everything and Worked find, unfortunately my firewall Dose not Allow DNS resolution from outside interface to in insideshould i apply another ACL or inspect DNS Traffic from outside to inside and VS?- ASA3/SRV-A(config)# packet-tracer input TO-OUT tcp 0.0.0.0 53 6.6.6.6 53Phase: 1Type: ACCESS-LISTSubtype:Result: ALLOWConfig:Implicit RuleAdditional Information:MAC Access listPhase: 2Type: ROU.
![Cisco Privilege Levels Cisco Privilege Levels](/uploads/1/2/5/6/125606036/736778646.png)
A malicious person that gains access to a switch or router can modify system integrity to steal information or disrupt communications. Cisco Certified Network Associates (CCNAs)-and other qualified network administrators-should know how to prevent attacks by securing networking devices. This course covers secure routing and switching, including mitigation procedures and VLAN switching, as covered by CCNA Security certification exam 210-260.
Specifically, Cisco IOS routers support privilege levels in the range 0 to 15. By default, when you attach to a router, you are in user mode, which has a privilege level of 0. After entering the enable command and providing appropriate credentials, you are moved to privileged mode, which has a privilege level of 15.
Lisa Bock, a security ambassador, explains the difference between the control, data, and management planes in networking, and provides to an overview of Layer 3 attacks and techniques for securing Cisco routers. Next, she addresses Layer 2 attacks and techniques to secure Cisco switches. She includes mitigation procedures such as dynamic ARP inspection and BPDU guard, and wraps up with a discussion of VLAN security.