Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 211)

13-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Adding an Extended Access List

See the following commands for this example:

hostname(config)# access-list INSIDE extended permit ip 10.1.1.0 255.255.255.0 host

10.1.1.56

hostname(config)# access-group INSIDE in interface inside

Adding an Extended Access List

An extended access list is made up of one or more ACEs, in which you can specify the line number to

insert the ACE, source and destination addresses, and, depending on the ACE type, the protocol, the

ports (for TCP or UDP), or the ICMP type (for ICMP). You can also specify a log option, disable an

ACE, and specify a tme range to allow access, You can identify all of these parameters within the

access-list command, or you can use object groups for each parameter. This section describes how to

identify the parameters within the command. To use object groups, see the “Simplifying Access Lists

with Object Grouping” section on page 13-13.

For TCP and UDP connections, you do not need to also apply an access list on the destination interface

to allow returning traffic, because the security appliance allows all returning traffic for established

connections. See the “Stateful Inspection Overview” section on page 1-4 for more information. For

connectionless protocols such as ICMP, however, you either need access lists to allow ICMP in both

directions (by applying access lists to the source and destination interfaces), or you need to enable the

ICMP inspection engine. The ICMP inspection engine treats ICMP sessions as stateful connections. For

transparent mode, you can allow protocols with an extended access list that are otherwise blocked by a

routed mode security appliance, including BGP, DHCP, and multicast streams. Because these protocols

do not have sessions on the security appliance to allow returning traffic, these protocols also require

access lists on both interfaces.

You can apply only one access list of each type (extended and EtherType) to each direction of an

interface. You can apply the same access lists on multiple interfaces.

Note If you change the access list configuration, and you do not want to wait for existing connections to time

out before the new access list information is used, you can clear the connections using the clear

local-host command.

To add an extended access list, perform the following steps:

Step 1 Add one or more ACEs of the following types using the same access list name.

When you enter the access-list command for a given access list name, the ACE is added to the end of

the access list.

Tip Enter the access_list_name in upper case letters so the name is easy to see in the configuration.

You might want to name the access list for the interface (for example, INSIDE), or for the

purpose for which it is created (for example, NO_NAT or VPN).

Note You specify a network mask in the access-list command (for example, 255.255.255.0 for a Class

C mask). This method is different from the Cisco IOS software access-list command, which uses

wildcard bits (for example, 0.0.0.255).

1 2 ... 206 207 208 209 210 211 212 213 214 215 216 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 211