This document discusses security levels in Cisco ASA firewalls and the order of operations for ACLs and NAT rules. It notes that interfaces with the same security level allow traffic between connected networks by default. It also explains that for ASA versions prior to 8.3, ACLs are evaluated before NAT for outbound traffic but NAT is evaluated before ACLs for inbound traffic, while for versions 8.3 and above ACLs are always evaluated before NAT rules for both inbound and outbound traffic.

1. Knowledge Sharing
1

2. Security Levels in Cisco ASA
2

3. CAB Template v18
Security Levels in Cisco ASA
Interface having same security level
3

4. Security
Levels in Cisco
ASA
• PC1 ping PC2:
4

5. Security Levels in Cisco ASA
PC2 ping PC1:
5

6. Security Levels in Cisco ASA
PC2 ping PC1: same security level
6

7. Security Levels
in Cisco ASA
• PC1 ping PC2: After enable
command below
• # same-security-traffic permit inter-
interface
• Best practice: Keep it disabled by
default. Always use access-list to
permit traffic
7

8. Whitelist ip in Firewall
-Cisco ASA
8
Via CLI /
ASDM
Ping
/traceroute
Network
Diagram
Search/trace
location of ip
NAT
required?
Use Show
commands
Configure

9. ACL and NAT order of operation
9
• ACL is evaluated first, then NAT rule
applied to the packet for both Inbound
and Outbound traffic
ASA version
prior to 8.3:
• Outbound traffic: ACL is evaluated first,
then only static NAT takes place
• Inbound traffic: NAT rule will be evaluated
first, then only ACL takes place
ASA version
8.3 and
above:

10. ACL and NAT order of operation
An inside host (10.1.1.10) translated to public address (200.200.200.10) for outbound
traffic (inside to outside)
ACL configuration is same for Cisco ASA version below 8.3 and above 8.3
10
ciscoasa(config)# access-list INSIDE extended permit ip host 10.1.1.10 host 100.100.100.1
ciscoasa(config)# access-group INSIDE in interface inside
object network inside-subnet
subnet 10.1.1.0 255.255.255.0
nat (inside,outside) dynamic interface

11. ACL and NAT order of operation
Inbound traffic coming from the Internet towards the public address of the Web Server
Cisco ASA prior to version 8.3: ACL reference to NAT IP
Cisco ASA 8.3 and above: ACL reference to REAL IP
11
Cisco ASA < 8.3
ciscoasa(config)# access-list OUTSIDE extended permit tcp any host 200.200.200.10 eq 80
ciscoasa(config)# access-group OUTSIDE in interface outside
object network WEB_SERVER
host 10.1.1.10
nat (inside,outside) static 200.200.200.10
Cisco ASA > 8.3
ciscoasa(config)# access-list OUTSIDE extended permit tcp any host 10.1.1.10 eq 80
ciscoasa(config)# access-group OUTSIDE in interface outside
object network WEB_SERVER
host 10.1.1.10
nat (inside,outside) static 200.200.200.10
Inboun
d