Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 213)

13-11

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Adding an EtherType Access List

For information about logging options that you can add to the end of the ACE, see the “Logging

Access List Activity” section on page 13-20.

See the following example:

The following access list restricts all hosts (on the interface to which you apply the access list) from

accessing a website at address 209.165.201.29. All other traffic is allowed.

hostname(config)# access-list ACL_IN extended deny tcp any host 209.165.201.29 eq www

hostname(config)# access-list ACL_IN extended permit ip any any

• Add an ACE for ICMP by entering the following command:

hostname(config)# access-list

access_list_name

[extended]

{deny | permit}

icmp

source_address mask

dest_address mask

[

icmp_type

]

Enter host keyword before the IP address to specify a single address. In this case, do not enter a

mask. Enter any keyword instead of the address and mask to specify any address.

Because ICMP is a connectionless protocol, you either need access lists to allow ICMP in both

directions (by applying access lists to the source and destination interfaces), or you need to enable

the ICMP inspection engine (see the “Adding an ICMP Type Object Group” section on page 13-16).

The ICMP inspection engine treats ICMP sessions as stateful connections.

To control ping, specify echo-reply (0) (security appliance to host) or echo (8) (host to security

appliance). See the “Adding an ICMP Type Object Group” section on page 13-16 for a list of ICMP

types.

Step 2 For information about logging options that you can add to the end of the ACE, see the “Logging Access

List Activity” section on page 13-20. For information about time range options, see “Time Range

Options” section on page 13-20.

Adding an EtherType Access List

Transparent firewall mode only

An EtherType ACE controls any EtherType identified by a 16-bit hexadecimal number. You can identify

some types by a keyword for convenience. If you add an ACE to an EtherType access list that specifically

denies all traffic, then that ACE also denies IP and ARP traffic, even if you have an extended access list

that allows IP traffic. The implicit deny at the end of all access lists allows IP and ARP through.

EtherType ACEs do not allow IPv6 traffic, even if you specify the IPv6 EtherType.

Because EtherTypes are connectionless, you need to apply the access list to both interfaces if you want

traffic to pass in both directions. For example, you can permit or deny bridge protocol data units. By

default, all BPDUs are denied. The security appliance receives trunk port (Cisco proprietary) BPDUs

because security appliance ports are trunk ports. Trunk BPDUs have VLAN information inside the

payload, so the security appliance modifies the payload with the outgoing VLAN if you allow BPDUs.

If you use failover, you must allow BPDUs on both interfaces with an EtherType access list to avoid

bridging loops.

If you allow MPLS, ensure that Label Distribution Protocol and Tag Distribution Protocol TCP

connections are established through the security appliance by configuring both MPLS routers connected

to the security appliance to use the IP address on the security appliance interface as the router-id for LDP

or TDP sessions. (LDP and TDP allow MPLS routers to negotiate the labels (addresses) used to forward

packets.)

1 2 ... 208 209 210 211 212 213 214 215 216 217 218 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 213

Kommentare zu diesen Handbüchern