Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 205)

13-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Access List Overview

For TCP and UDP connections, you do not need an access list to allow returning traffic, because the

security appliance allows all returning traffic for established connections. For connectionless protocols

such as ICMP, however, you either need access lists to allow ICMP in both directions (by applying access

lists to the source and destination interfaces), or you need to enable the ICMP inspection engine (see the

“Adding an ICMP Type Object Group” section on page 13-16). The ICMP inspection engine treats ICMP

sessions as stateful connections.

You can apply one access list of each type to each direction of an interface. You can also apply the same

access lists on multiple interfaces.

To control network access for IP traffic, perform the following task:

1. Create the access list according to the “Adding an Extended Access List” section on page 13-9.

2. Apply the access list according to the “Applying an Access List to an Interface” section on

page 15-4.

Allowing Special Traffic through the Transparent Firewall

In routed firewall mode, some types of traffic are blocked even if you allow them in an access list,

including unsupported dynamic routing protocols, DHCP (unless you configure DHCP relay), and

multicast traffic. Transparent firewall mode can allow any IP traffic through. Because these special types

of traffic are connectionless, you need to apply an access list to both interfaces, so returning traffic is

allowed through.

Table 13-2 lists common traffic types that you can allow through the transparent firewall. See

Appendix D, “Addresses, Protocols, and Ports,” for more information on protocols and ports.

Identifying Traffic for AAA Rules (Extended)

Access lists can be used with AAA in several ways:

• To identify traffic for network access authorization using a TACACS+ server, perform the following

tasks:

a. Add the access list using the “Adding an Extended Access List” section on page 13-9.

Permit entries in the access list mark matching traffic for authorization, while deny entries

exclude matching traffic from authorization.

Table 13-2 Transparent Firewall Special Traffic

Traffic Type Protocol or Port Notes

BGP

1. Border Gateway Protocol

TCP port 179 —

DHCP

2. Dynamic Host Configuration Protocol

UDP ports 67 and 68 If you enable the DHCP server, then the security

appliance does not pass DHCP packets.

EIGRP

3. Enhanced Interior Gateway Routing Protocol

Protocol 88 —

Multicast streams The UDP ports vary depending

on the application.

Multicast streams are always destined to a

Class D address (224.0.0.0 to 239.x.x.x).

OSPF Protocol 89 —

RIP (v1 or v2) UDP port 520 —

1 2 ... 200 201 202 203 204 205 206 207 208 209 210 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 205

Kommentare zu diesen Handbüchern