Jimmy,
I think Willians was heading in the correct direction. But you shouldn't typically have it at the same security levels. But having them at the same security level without the command I stated you will see deny messages and you will not understand why you are seeing them. That is why both Willians and I were pointing you in that direction. Regards, Tyson Scott - CCIE #13513 R&S, Security, and SP Technical Instructor - IPexpert, Inc. Mailto: <mailto:[email protected]> [email protected] Telephone: +1.810.326.1444, ext. 208 Live Assistance, Please visit: <http://www.ipexpert.com/chat> www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, Audio Tools, Online Hardware Rental and Classroom Training for the Cisco CCIE (R&S, Voice, Security & Service Provider) certification(s) with training locations throughout the United States, Europe, South Asia and Australia. Be sure to visit our online communities at <http://www.ipexpert.com/communities> www.ipexpert.com/communities and our public website at <http://www.ipexpert.com/> www.ipexpert.com From: [email protected] [mailto:[email protected]] On Behalf Of Jimmy Larsson Sent: Tuesday, April 27, 2010 2:18 PM To: OSL Security Subject: Re: [OSL | CCIE_Security] problem pinging thru asa from DMZ in WB2 Lab 12. My lab session is over and I dont have access to very much right now. Are you saying that the tasks told me to put DMZ to security-level 0? In that case Ive totally forgotten about it. I am quite (but not totally!) sure that it was put to something like 25 or 50 or something. In general, when you get a log message like this: %ASA-3-106014: Deny inbound ..." without mentioning any acl:s, what causes can there be to get this message? Traffic lower security to higher? Hairpinning (missing same-security permit intra-interface)? Traffic between two interfaces with the same security-level (without same-security permit inter-interface)? Anything else? Br Jimmy 2010/4/27 Tyson Scott <[email protected]> Default security levels are 0 for both unless you changed it. If so you need to allow same-security-traffic permit inter-interface Regards, Tyson Scott - CCIE #13513 R&S, Security, and SP Technical Instructor - IPexpert, Inc. Mailto: [email protected] Telephone: +1.810.326.1444, ext. 208 Live Assistance, Please visit: www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, Audio Tools, Online Hardware Rental and Classroom Training for the Cisco CCIE (R&S, Voice, Security & Service Provider) certification(s) with training locations throughout the United States, Europe, South Asia and Australia. Be sure to visit our online communities at www.ipexpert.com/communities and our public website at www.ipexpert.com -- ------- Jimmy Larsson Ryavagen 173 s-26030 Vallakra Sweden http://blogg.kvistofta.nu -------
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
