ccna but no experience

ccna but no experience.9.2 ASA Firewall Configuration 273to filter traffic going to the ASA control plane. It takes one step to complete, but requires additional rule sets to enforce access control. ASA devices also differ from router devices in terms of interface security levels. By default, security levels do not require ACLs to be configured when access control is applied. for example, traffic from a more secure interface (such as security level 100) is allowed to access a less secure interface (such as security level0); conversely, the traffic will be blocked.For example, a host from an internal network with a security level of 100 can access an external interface with a security level of 0. However, a host from an external interface with a full level 0 cannot access an internal interface with a higher security level. If required, an ACL must be explicitly configured to allow traffic from the lower security level to the higher security level.Note: To allow connections on two interfaces with the same security level, the same-security-traffic permit inter-interface global configuration mode command is required. To allow traffic in and out of the same interface, such as when encrypted traffic enters an interface and then unencrypted traffic is routed out through the same interface, you need to use the same-security-trafficpermitintra-interface global configuration mode command. These commands are beyond the scope of this chapter.274 Chapter 9 Implementing Cisco Adaptive Security Appliances (AS A)9.2.6.3 Types of ASA ACLsThe ASA supports 5 types of access lists.Extended access lists: the most common type of ACL. Contains one or more ACEs to specify source and destination addresses and protocols, ports (for TCP or UDP), or ICMP types (for ICMP)Standard Access Lists: Unlike standard ACLs in IOS that identify the source host/network, standard ACLs in ASA are used to identify the destination 1P address. They are typically used only for OSPF routing and are used in OSPF redistributed route maps. Standard access lists cannot be applied to control traffic on an interface.