I have a new cisco asa 5512
Cisco Adaptive Security Appliance Software Version 8.6(1)2 Device Manager Version 6.6(1)
with the Security Plus Licence.
I have a number of VLAN's containing servers that need to be fire walled from each other, the hosts should only be able to communicate with each other via port 80.
I have the following interfaces.
Outside gigabitinterface 0/0
The VLAN's are setup as subinterfaces of gigabitethernet 0/1
gig 0/1.130 VLAN 130 - 192.168.130.0/24 - security level 100
gig 0/1.131 VLAN 131 - 192.168.130.0/24 - security level 100
gig 0/1.132 VLAN 132 - 192.168.130.0/24 - security level 100
I have given each interface the same security level as I don't want full access from one VLAN to another. I then tried to add access list rules to allow one VLAN to talk to another however they don't appear to work.
I can enable the
'Enable traffic between two or more interfaces which are configured with same security levels'
feature, however this enables all traffic to route between the different VLAN's unrestricted.
What is the best way to solve my issue? Do I 'enable the traffic between the interfaces with the same security levels' and then add access lists to deny all the traffic between the VLAN's except on port 80? Or should access lists allow traffic to pass between VLAN's without this feature enabled.
Thanks for any help.