asa security levels, the number that runs the firewall

the number nobody explains properly

if you've ever stared at a cisco asa config and seen "security-level 100" or "security-level 0" sitting next to an interface and just nodded like you understood, you're not alone. this one number is doing more work than almost anything else in the config. it's not a vlan tag, it's not an acl, it's a trust score. once you get how it thinks, the whole asa stops feeling like a black box.

the basic rule: high trusts low, low doesn't trust high

every interface on an asa gets assigned a security level from 0 to 100. higher number means more trusted. lower number means less trusted. the default behavior, before you write a single access list, is this:

traffic from a high security level to a low security level is allowed.
traffic from a low security level to a high security level is denied.

that's it. that's the whole engine. the classic setup looks like this:

inside  = 100
dmz     = 50
outside = 0

inside can talk to dmz and outside without you writing a permit rule. outside trying to reach inside gets slammed shut by default. it's not magic, it's just math: 100 > 50 > 0, so traffic flows downhill and gets stopped going uphill unless you explicitly allow it.

why this matters if you're defending a network

the reason this design exists is to give you a sane default posture. you don't have to remember to block "internet to internal servers," the asa already assumes that's a bad idea unless you say otherwise. that's a defender's best friend: secure by default, and you only open holes on purpose.

the flip side is just as important. if you're auditing a firewall you inherited, the security levels tell you the intended trust model at a glance. an interface sitting at 100 that isn't your actual inside network is a red flag. someone either misconfigured it or someone was lazy and it's been exposed longer than it should've been.

same-level and equal-level traffic, the part people forget

two interfaces with the same security level do not talk to each other by default, even though "same level" sounds like it should mean "equal trust, should be fine." the asa blocks it until you explicitly enable inter-interface communication for same-level traffic. this trips people up constantly when they build multiple dmz segments at level 50 and wonder why servers in dmz-a can't reach servers in dmz-b. that's not a bug, that's the asa refusing to assume anything.

the acl always wins

security levels set the default posture, but an access list on an interface overrides that default. so a high-to-low allow can still get blocked if you write a deny acl. and a low-to-high deny can be overridden if you explicitly permit that traffic in an acl. this is where a lot of real-world misconfigs live. someone slaps a permissive acl on the outside interface "just to test something" and forgets to pull it. now your level-0 interface has an open door straight to your level-100 network and the whole trust model you thought you had is decorative.

how to check your own asa

if you manage an asa, or you inherited one from someone who left no notes, go look at the actual assigned levels before you assume anything:

show run interface
show nameif

confirm every interface's security-level matches what it's supposed to be. confirm the ones facing your isp or guest wifi are genuinely at the bottom of the trust scale, not accidentally bumped up during some past troubleshooting session. then pull the access lists on each interface and check for anything that overrides the default deny you're relying on. a security-level of 0 means nothing if there's a stale permit-any acl sitting on top of it.

the takeaway

the security level is the asa's built-in common sense. it assumes untrusted networks shouldn't reach trusted ones unless you say so, and that's exactly the assumption you want running in the background of your firewall. your job as the defender isn't to memorize the numbers, it's to make sure the numbers still match reality, and that no forgotten acl is quietly undoing the protection they're supposed to give you. check it today, not after something gets in through the hole nobody remembered they opened.