Cisco PIX 525 Especificaciones descargar pdf (Pagina 204)

100

101

13-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Access List Overview

Access List Types and Uses

This section includes the following topics:

• Access List Type Overview, page 13-2

• Controlling Network Access for IP Traffic (Extended), page 13-2

• Identifying Traffic for AAA Rules (Extended), page 13-3

• Controlling Network Access for IP Traffic for a Given User (Extended), page 13-4

• Identifying Addresses for Policy NAT and NAT Exemption (Extended), page 13-4

• VPN Access (Extended), page 13-5

• Controlling Network Access for Non-IP Traffic (EtherType), page 13-6

• Redistributing OSPF Routes (Standard), page 13-6

Access List Type Overview

Table 13-1 lists the types of access lists you can create and how you can use them.

Controlling Network Access for IP Traffic (Extended)

Extended access lists control connections based on source address, destination address, protocol, or port.

The security appliance does not allow any traffic from a lower security interface to a higher security

interface unless it is explicitly permitted by an extended access list. However, traffic is permitted from

a higher security interface to a lower security interface without an extended access list. These rules are

true for both routed firewall mode and transparent firewall mode.

Table 13-1 Access List Types and Uses

Access List Use Access List Type For More Information

Control network access for IP traffic Extended See the “Controlling Network Access for IP Traffic for a

Given User (Extended)” section on page 13-4.

Identify traffic for AAA rules Extended See the “Identifying Traffic for AAA Rules (Extended)”

section on page 13-3.

Control network access for IP traffic for a

given user

Extended,

downloaded from a

AAA server per user

See the “Controlling Network Access for IP Traffic for a

Given User (Extended)” section on page 13-4.

Identify addresses for NAT (policy NAT

and NAT exemption)

Extended See the “Identifying Addresses for Policy NAT and NAT

Exemption (Extended)” section on page 13-4.

Establish VPN access Extended See the “VPN Access (Extended)” section on page 13-5.

Identify traffic in a traffic class map for

Modular Policy

Extended See the “Identify Traffic in a Class Map for Modular

Policy Framework” section on page 13-5

For transparent firewall mode, control

network access for non-IP traffic

EtherType See the “Controlling Network Access for Non-IP Traffic

(EtherType)” section on page 13-6.

Identify OSPF route redistribution Standard See the “Redistributing OSPF Routes (Standard)” section

on page 13-6.

1 2 ... 199 200 201 202 203 204 205 206 207 208 209 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 204

Comentarios a estos manuales