I have an Cisco ASA 5510 configured thus:
interface Ethernet0/0 description ### Trunk for inside, wlan ### speed 1000 no nameif no security-level no ip address interface Ethernet0/0.10 description ### OFFICE ### vlan 10 nameif inside security-level 100 ip address 172.18.0.1 255.255.255.0 interface Ethernet0/0.12 description ### WIRELESS ### vlan 12 nameif wlan security-level 20 ip address 172.18.2.1 255.255.255.128 interface Ethernet0/3 description ### Upstream ### nameif outside security-level 0 ip address X.X.X.X 255.255.255.252 access-group WLAN in interface wlan global (outside) 10 interface nat (wlan) 0 access-list NONATWIRELESS nat (wlan) 10 172.18.2.0 255.255.255.128 nat (inside) 0 access-list NONATINSIDE nat (inside) 10 172.18.0.0 255.255.255.0 dhcprelay server ZZZ inside dhcprelay enable wlan access-list WLAN extended permit object-group DNS object-group WLAN host nic access-list WLAN extended permit object-group DNS object-group WLAN host idns access-list NONATWIRELESS extended permit ip any 172.18.0.0 255.255.255.0 access-list NONATWIRELESS extended permit ip any 172.18.3.0 255.255.255.0 access-list NONATINSIDE extended permit ip any 172.18.2.0 255.255.255.0 access-list NONATINSIDE extended permit ip any 172.18.3.0 255.255.255.0 no nat-control
There are no static routes.
On this configuration, hosts on vlan 10 are allowed to access the outside world, but hosts on vlan 12 are not. They provoke like log entries:
Jan 13 14:35:02 172.18.0.1 %ASA-4-106023: Deny tcp src wlan:172.18.2.125/48593 dst outside:Y.Y.Y.Y/80 by access-group "WLAN" [0x0, 0x0]
EDIT: I suppose this is because there is an access-list on wlan but not on inside, but this seems stupid? security-level should still be evaluated if there are no matching entries in the access-list?