Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a new cisco asa 5512

Cisco Adaptive Security Appliance Software Version 8.6(1)2 Device Manager Version 6.6(1)

with the Security Plus Licence.

I have a number of VLAN's containing servers that need to be fire walled from each other, the hosts should only be able to communicate with each other via port 80.

I have the following interfaces.

Outside gigabitinterface 0/0

The VLAN's are setup as subinterfaces of gigabitethernet 0/1

gig 0/1.130 VLAN 130 - - security level 100

gig 0/1.131 VLAN 131 - - security level 100

gig 0/1.132 VLAN 132 - - security level 100

I have given each interface the same security level as I don't want full access from one VLAN to another. I then tried to add access list rules to allow one VLAN to talk to another however they don't appear to work.

I can enable the

'Enable traffic between two or more interfaces which are configured with same security levels'

feature, however this enables all traffic to route between the different VLAN's unrestricted.

What is the best way to solve my issue? Do I 'enable the traffic between the interfaces with the same security levels' and then add access lists to deny all the traffic between the VLAN's except on port 80? Or should access lists allow traffic to pass between VLAN's without this feature enabled.

Thanks for any help.

share|improve this question
please paste the access lists that you tried to apply, and any NAT rules. also, are you sure the interface IP settings for each subinterface are correct? i ask only because you've got vlan 131 and vlan 132 with the same subnet as vlan 130. –  sjw Jul 24 '13 at 19:55
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.