Cisco ASA VLANs and Sub-Interfaces

Hi Mark,

By default, all traffic from a higher security level (OUTSIDE) to a lower security level (INSIDE) will be dropped. The only thing you have to do is to create an access-list and permit the traffic you want. Take a look at this example:

https://networklessons.com/cisco/cisco-asa/cisco-asa-access-list/

Look for the “Permit Traffic to DMZ” section. Instead of the DMZ, it will be INSIDE for you.

The ASA will use regular routing to select the egress interface. Let’s say you have an INSIDE gi0/1.10 sub-interface with IP address 192.168.1.254/24 on it. If you receive a packet on one of your OUTSIDE sub-interfaces with source 1.2.3.4 and destination 192.168.1.55 then it will forward the packet on your gi0/1.10 sub-interface (if it is permitted with an access-list).

Since ASA 9.4, it is also possible to use PBR (Policy Based Routing) to overrule default routing behavior btw.

Rene