Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an asa5505 and I need to figure out how to isolate one physical interface to the other but remaining with access to our servers. my original thought was to put them on the same subnet as the main network and isolate them via the feature to block certain interfaces from eachother... But this doesnt seem to do the trick as they are on different subnets.

Is there any ideas?


share|improve this question
By default, the ASA blocks traffic between interfaces at the same security level. Of course, security levels only come into play when there are no ACL's on the interface. Can you give a brief description of the topology - most importantly, where are the servers? – Paul Ackerman Dec 5 '11 at 14:46
Hey Paul, the servers plug into a switch that plugs into port 0/3. So basically 0/0 is the internet port 0/1 is the data port 0/2 0/3 is the server port 0/4 is the dev team (server access. blocked from 0/1 traffic) I wanted to put them on seperate subnets. for example data is 192.168.10.x 0/2 would be 192.168.20.x and so on. Because it puts it on different subnets though it makes so they will not communicate. Maybe i'm doing it weird though. Lol. – Lbaker101 Dec 5 '11 at 20:50
Do you have a windows cluster or something that needs to be on the same subnet? If not, I'm not sure I understand why they would not communicate just because they are on different subnets. I agree with Jeff, put them on unique interfaces and subnets then use firewall rules to allow/disallow traffic as needed. If you absolutely must separate traffic on the same subnet, there are a couple ways. You can use host-based firewalls or IPSec to determine allowed connections on the important servers or use interface ACLs on the switches themselves but that will be messy. Easier in the firewall. – Paul Ackerman Dec 5 '11 at 21:30
I have enabled to allow networks of the same security level to connect. I have also allowed any/any on both the dev/server/ISP interfaces (to rule out security). Right now i'm working through ASDM while I learn the CLI a bit more. so the 3 networks are: 0/0 is the ISP interface 192.168.10.x (data) 0/1 192.168.30.x (server interface) 0/3 192.168.40.x (Dev interface) 0/4 So i'm guessing i'm missing something. Let me go test it again. Thanks! – Lbaker101 Dec 5 '11 at 22:26
up vote 3 down vote accepted

On the "Server Interface"... ALLOW all traffic from "Client Interface" Destined to Servers DENY all traffic from "Client Interface"

In that order. You could restrict the ALLOW rule to specific ports if needed.

On the "Server Interface"... ALLOW all traffic from Servers DENY all traffic from "Server Interface"

In that order. Again, you could restrict the ALLOW rule to specific ports if needed.

share|improve this answer
I can seperate the subnets and put them on different networks but then they would not communicate with eachother. If its on the same I need both networks to communicate with the servers but totally blocked from eachother. I didnt think about taking the firewall route though so I will let you guys know how that works out! – Lbaker101 Dec 5 '11 at 16:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.