Cisco ASA Security Levels Explained

Learn how Cisco ASA security levels from 0 to 100 control default traffic flow between inside, DMZ, and outside interfaces, including stateful return traffic.

A Cisco Adaptive Security Appliance (ASA) is a firewall platform that applies stateful traffic controls. One of its fundamental concepts is the security level assigned to each interface.

A security level is a number from 0 through 100 that represents the relative trust of the network connected to an interface. A higher number indicates a more trusted network; a lower number indicates a less trusted network.

Security levels establish default behavior for new connections, but they are not a complete security policy. Access control lists (ACLs), NAT, routing, interface status, and service configuration can also determine whether traffic succeeds.

How ASA Security Levels Work

For a new connection, the ASA compares the security level of the source interface with the security level of the destination interface:

Higher-to-lower traffic: New traffic from a higher security level toward a lower security level is permitted by default.
Lower-to-higher traffic: New traffic from a lower security level toward a higher security level is denied by default.
Equal-level traffic: Traffic between interfaces with the same security level is denied by default.

These rules express a trust relationship. They do not mean that every application, address, or packet is automatically safe. Explicit policy may further restrict or permit traffic.

Common Interface Security Levels

Interface role	Typical security level	Relative trust	Typical connected network
inside	100	highest	internal LAN
DMZ	50	intermediate	public-facing server segment
outside	0	lowest	Internet or other untrusted network

The conventional inside interface connects to the trusted internal network and commonly uses level 100. The outside interface connects to the Internet or another untrusted network and commonly uses level 0.

A DMZ, or demilitarized zone, is a separate network for systems that need controlled exposure, such as public web servers. It is normally less trusted than the inside LAN but more trusted than the public Internet, so level 50 is a common choice.

The exact values are design decisions. The important relationship is the ordering: inside is more trusted than the DMZ, and the DMZ is more trusted than outside.

Standard Three-Zone Topology

Consider an ASA with these interfaces:

inside: level 100, connected to the internal LAN
dmz: level 50, connected to a server segment
outside: level 0, connected to the Internet

Compare the source and destination levels first. Then determine whether the traffic is an initial connection or return traffic for an already permitted session.

Default Initial-Connection Behavior

Source zone	Source level	Destination zone	Destination level	New connection allowed by default?	Reason
inside	100	DMZ	50	yes	higher to lower
inside	100	outside	0	yes	higher to lower
DMZ	50	outside	0	yes	higher to lower
DMZ	50	inside	100	no	lower to higher
outside	0	DMZ	50	no	lower to higher
outside	0	inside	100	no	lower to higher

Inside to DMZ

An inside host at level 100 can initiate a new session to a DMZ host at level 50 by the default security-level rule. For example, an administrator on the LAN could connect to a DMZ server for management, subject to any additional ACL, NAT, and routing requirements.

Inside to Outside

An inside host can initiate a connection to an Internet host because level 100 is higher than level 0. This is the typical direction for web browsing, DNS queries, and other outbound services. NAT is commonly needed so that the internal source address can be translated for the external network.

DMZ to Outside

A DMZ host at level 50 can initiate a new connection toward the Internet at level 0. This may be useful for updates or external services, but an organization may restrict it with an ACL or other policy.

DMZ to Inside

A DMZ host cannot initiate a new connection to an inside host by default. The flow moves from level 50 to level 100, which is lower-to-higher traffic. This protects the internal network if a DMZ server is compromised.

Outside to DMZ

An Internet host cannot initiate a new connection to a DMZ host by default. Although DMZ servers are often intended to provide public services, publishing a service requires deliberate policy, usually including an inbound ACL and NAT configuration.

Outside to Inside

An Internet host cannot initiate a new connection to an inside host by default. The flow moves from level 0 to level 100 and is therefore lower-to-higher traffic. Allowing such access requires intentional policy and commonly address translation or service-publication configuration.

Stateful Inspection and Return Traffic

Stateful inspection means that the ASA tracks permitted sessions. It records connection information such as endpoints, protocols, and session state, then uses that information to recognize valid responses.

Initial traffic is the first flow that attempts to create a new connection. Return traffic is response traffic associated with a session that the ASA has already permitted and tracked.

For example, an inside client at level 100 initiates HTTPS traffic to an Internet server at level 0. The initial connection is allowed by the higher-to-lower default. When the Internet server sends HTTPS responses back, the ASA permits those packets when they match the tracked session.

The response packet travels in the opposite direction, but it is not treated as a new outside-to-inside connection. It is recognized as return traffic for the already permitted inside-to-outside session.

Traffic type	Example	ASA decision basis	Default outcome
initial traffic	outside host starts a connection to inside	security direction and explicit policy	denied by default
return traffic	Internet server replies to an inside-initiated session	stateful session match	allowed when valid

Equal Security Levels

Interfaces with identical security levels do not permit traffic between each other by default. For example, two interfaces configured at level 50 cannot automatically exchange new traffic merely because their levels are equal.

ASA supports an optional setting that permits inter-interface traffic between equal-security interfaces:

same-security-traffic permit inter-interface

This is an explicit exception to the normal behavior. It does not make equal-level traffic equivalent to higher-to-lower traffic, and it should be used with appropriate ACL and NAT design.

Assigning Interface Names and Security Levels

The following example assigns conventional roles and levels:

interface GigabitEthernet0/0
 nameif outside
 security-level 0
interface GigabitEthernet0/1
 nameif inside
 security-level 100
interface GigabitEthernet0/2
 nameif dmz
 security-level 50

Interface addressing and activation are separate requirements. A complete interface configuration also needs an appropriate IP address and an enabled operational state. Select levels that match the intended trust relationship rather than blindly copying these values.

Verify the Configuration

show interface ip brief
show running-config interface

Use the output to confirm interface names, IP addresses, operational status, and security-level assignments.

Security Levels Versus Explicit Policy

Security levels provide default direction-based behavior, but they are not a replacement for:

ACLs: Explicitly permit or deny defined source, destination, protocol, and service traffic.
NAT: Translate addresses when required for outbound access or published services.
Routing: Ensure that the ASA and connected networks know where traffic should go.
Interface configuration: Provide correct names, addresses, status, and connectivity.

For example, an outside user accessing an HTTPS server in the DMZ requires more than the DMZ's level 50. The ASA commonly needs an inbound ACL permitting the service, static or equivalent NAT to publish the server, correct routing, and a service that is listening on the expected address and port.

Likewise, a lower-security network can be granted controlled access to a higher-security network only through deliberate policy configuration. The security-level default does not authorize that access automatically.

Traffic-Flow Analysis Method

Identify the source interface and its security level.
Identify the destination interface and its security level.
Compare the two levels.
Decide whether the packet starts a new connection or belongs to an existing tracked session.
For a new connection, apply the default direction rule and check ACL requirements.
For return traffic, verify that it matches the permitted stateful session.
Check NAT, routing, interface status, and the destination service if the flow still fails.

Practical Examples

Inside Host Browsing to an External Web Server

An inside client at level 100 initiates HTTPS to an Internet server through outside level 0. The initial outbound connection is permitted by the higher-to-lower default. The server's responses are permitted because they match the established stateful session.

Internet Host Attempting to Reach an Inside Workstation

An outside host at level 0 starts a new connection to an inside workstation at level 100. The ASA denies it by default because the flow is lower-to-higher. If remote access is required, configure intentional policy and the necessary NAT, routing, and service controls.

Public Access to a DMZ Server

An Internet host attempting to reach a DMZ server is also initiating lower-to-higher traffic, from level 0 to level 50. The default level-only behavior denies the new session. A published service requires an appropriate ACL and NAT configuration in addition to correct routing and server operation.

Two Interfaces at Level 50

Two interfaces both configured at level 50 cannot exchange new traffic by default. If communication is required, enable same-security-traffic permit inter-interface and apply narrowly scoped ACL and NAT controls.

Troubleshooting Common Problems

A DMZ Server Cannot Start a Connection to an Inside Host

The likely cause is the default lower-to-higher behavior: level 50 to level 100.

Confirm the source and destination interface levels.
Confirm that the traffic is a new connection rather than a response.
Review ACL, NAT, and routing requirements if the communication is intended.

An Internet Host Cannot Reach a DMZ Service

Outside-to-DMZ traffic moves from level 0 to level 50 and is blocked by default without deliberate service-publication policy.

Verify the outside and DMZ security levels.
Verify the inbound ACL or other access policy.
Verify static NAT or other applicable address translation.
Verify routing and confirm that the target service is listening.

Reply Traffic Is Denied After an Internal Client Starts an Outbound Session

If return packets do not match the ASA state table, the ASA may not recognize them as responses. NAT, routing, asymmetric paths, or an ACL can also interfere.

Confirm that the initial connection was permitted.
Check whether the response returns through the same ASA and expected interface.
Inspect NAT and routing for asymmetric return paths.
Review connection and access-policy information.

Equal-Level Interfaces Cannot Communicate

Confirm that both interfaces have the same level and determine whether communication is actually required. If it is, enable equal-security inter-interface traffic and validate the ACL and NAT policy.

Key Points to Remember

Every ASA interface has a security level from 0 to 100.
Higher values represent greater relative trust.
Inside, DMZ, and outside are commonly assigned 100, 50, and 0.
New higher-to-lower traffic is allowed by default; new lower-to-higher traffic is denied.
Equal-level interfaces are isolated by default unless inter-interface traffic is explicitly enabled.
Stateful inspection permits valid responses to sessions that the ASA already accepted.
Security levels do not replace ACLs, NAT, routing, or correct interface configuration.

For broader context, review the Cisco ASA overview, Cisco ASA features, and CCNA Security resources.