Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 115)

3-3

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Enabling Inbound Connections

You use the access-list and access-group commands to permit access based on source or destination IP

address, or by the protocol port number. Use the access-list command to create a single access list entry,

and use the access-group command to bind one or more access list entries to a specific interface. Only

specify one access-group command for each interface.

Note To allow access only for specific users, set up authentication, as described in “Using Authentication and

Authorization.”

Before you can set up an access list for a host, set up address translation by using a global or static

command. Setting up address translation with the global command is described in

Chapter 2,

“Establishing Connectivity.” Setting up address translation using the static command was described

earlier in the previous section “Enabling Server Access with Static NAT.”

The access-list command has many features, some of which are described in the following sections:

• Using TurboACL, page 3-18

• Downloading Access Lists, page 3-20

• Simplifying Access Control with Object Grouping, page 3-24

For the complete syntax of the access-list command, see the Cisco PIX Firewall Command Reference.

The basic syntax for the access-list command is as follows:

access-list ID [line line-num] {deny|permit} protocol <source_address | interface if_name>

[operator port] destination_address [operator port]

• Replace ID with a name or number you create to identify a group of access-list command

statements; for example, “acl_inbound,” which identifies that the permissions apply to access from

the outside interface.

• To insert a remark or an access control entry (ACE), use the line keyword. Replace line-num with

the line number at which to make the insertion.

• Use permit or deny depending on whether you want to permit or deny access to the server. By

default, all inbound access is denied, so you must permit access to a specific protocol or port.

• Replace protocol with the protocol (tcp or udp). For most servers, such as HTTP or email, use tcp.

For a complete list of permitted keywords and well-known port assignments, see “

Protocols and

Applications” in Appendix D, “TCP/IP Reference Information.”

• Replace source_address with the host or network address for those systems on the lower security

level interface that must access the destination_address. Use any to let any host access the

destination_address. If you specify a single host, precede the address with host; for example

host

192.168.1.2

. If you specify a network address, also specify a network mask; for example,

192.168.1.0 255.255.255.0.

Use the interface keyword if the interface has a dynamically assigned IP address. Replace if_name

with the name of the interface configured using the nameif command.

• Use an operator to match port numbers used by the source or destination. The permitted operators

are as follows:

–

lt—less than

–

gt—greater than

–

eq—equal to

–

negq—not equal to

–

range—an inclusive range of values

1 2 ... 110 111 112 113 114 115 116 117 118 119 120 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 115

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525