2 Replies Latest reply on Feb 18, 2015 9:28 AM by mike18

    If source and destination are behind same Zone

    mike18

      Hi Everyone,

       

      In Cisco ASA if source and destination are behind the same Interface we do not need Access control list.

      In Mcafee if we have source and destination using same zone do we need ACL to allow the traffic ?

       

       

      Regards

       

      Mike

        • 1. Re: If source and destination are behind same Zone
          PhilM

          The same applies.

           

          If the source and destination hosts are located within the same zone there should be no reason why the traffic should ever go anywhere near the Firewall and, therefore, won't need to be governed by an access rule. Access rules are only needed where traffic passes between zone boundaries. There are a couple of exceptions where rules are needed to control services running on the Firewall itself.

           

          One example where traffic between two hosts on the same zone could pass through the Firewall is when you have a publicly accessible web server located on the same zone as a client machine but DNS hasn't been configured correctly. The internal client tries to access the site (www.acme.com, for example) and because there is no authoritative DNS server available on that zone to resolve the hostname the request is sent to the internet, where an external DNS server resolves the hostname to an external IP address on the Firewall. This would then force the client to direct the HTTP/S request to that IP address - resulting in traffic crossing from the internal zone to the external zone, only then for it to have to come all the way back again. You can use NAT configuration within a rule to allow this to happen, but the advisable option in this example would be to have a correctly configured DNS server running in that zone that resolves the client's request to the correct internal address for the server.

           

          -Phil.

          • 2. Re: If source and destination are behind same Zone
            mike18

            Seems i need to learn lot about about MCafee world.

             

            Regards

             

             

             

            Mike