Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 208)

100

101

13-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Access List Overview

Controlling Network Access for Non-IP Traffic (EtherType)

Transparent firewall mode only

You can configure an access list that controls traffic based on its EtherType. The security appliance can

control any EtherType identified by a 16-bit hexadecimal number. EtherType access lists support

Ethernet V2 frames. 802.3-formatted frames are not handled by the access list because they use a length

field as opposed to a type field. Bridge protocol data units, which are handled by the access list, are the

only exception: they are SNAP-encapsulated, and the security appliance is designed to specifically

handle BPDUs.

To control non-IP traffic, perform the following task:

1. Create the access list according to the “Adding an EtherType Access List” section on page 13-11.

2. Apply the access list according to the “Applying an Access List to an Interface” section on

page 15-4.

Redistributing OSPF Routes (Standard)

Single context mode only

Standard access lists include only the destination address. You can use a standard access list with the

route-map command to control the redistribution of OSPF routes, perform the following tasks:

1. Create the access list according to the “Adding a Standard Access List” section on page 13-13.

2. Create a route map and apply it according to the “Redistributing Routes Between OSPF Processes”

section on page 8-5.

Access List Guidelines

This section describes the guidelines for creating access lists.

This section includes the following topics:

• Access Control Entry Order, page 13-6

• Access Control Implicit Deny, page 13-7

• IP Addresses Used for Access Lists When You Use NAT, page 13-7

Access Control Entry Order

An access list is made up of one or more Access Control Elements. Depending on the access list type,

you can specify the source and destination addresses, the protocol, the ports (for TCP or UDP), the ICMP

type (for ICMP), or the EtherType.

Each ACE that you enter for a given access list name is appended to the end of the access list.

The order of ACEs is important. When the security appliance decides whether to forward or drop a

packet, the security appliance tests the packet against each ACE in the order in which the entries are

listed. After a match is found, no more ACEs are checked. For example, if you create an ACE at the

beginning of an access list that explicitly permits all traffic, no further statements are ever checked.

You can disable an Access Control Element by specifying the keyword inactive in the access-list

command.

1 2 ... 203 204 205 206 207 208 209 210 211 212 213 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 208

Komentarze do niniejszej Instrukcji