Filter
Top Products
20-2
Cisco ASDM User Guide
OL-16647-01
Chapter 20 Configuring Access Rules and EtherType Rules
Information About Access Rules and EtherType Rules
Information About Both Access Rules and EtherType Rules
This section describes information for both access rules and EtherType rules, and includes the following
topics:
• Using Access Rules and EtherType Rules on the Same Interface, page 20-2
• Rule Order, page 20-2
• Implicit Deny, page 20-2
• Inbound and Outbound Rules, page 20-2
Using Access Rules and EtherType Rules on the Same Interface
You can apply both access rules and EtherType rules to each direction of an interface.
Rule Order
The order of rules is important. When the security appliance decides whether to forward or drop a packet,
the security appliance tests the packet against each rule in the order in which the rules are listed. After
a match is found, no more rules are checked. For example, if you create an access rule at the beginning
that explicitly permits all traffic for an interface, no further rules are ever checked.
You can disable a rule by making it inactive.
Implicit Deny
Lists of access rules or EtherType rules have an implicit deny at the end of the list, so unless you
explicitly permit it, traffic cannot pass. For example, if you want to allow all users to access a network
through the security appliance except for particular addresses, then you need to deny the particular
addresses and then permit all others.
For EtherType rules, the implicit deny does not affect IPv4 traffic or ARPs; for example, if you allow
EtherType 8037 (the EtherType for IPX), the implicit deny at the end of the list does not block any IP
traffic that you previously allowed with an access rule (or implicitly allowed from a high security
interface to a low security interface). However, if you explicitly deny all traffic with an EtherType rule,
then IP and ARP traffic is denied.
Inbound and Outbound Rules
By default, all traffic from a higher-security interface to a lower-security interface is allowed. Access
lists let you either allow traffic from lower-security interfaces, or restrict traffic from higher-security
interfaces.
The security appliance supports two types of access lists:
• Inbound—Inbound access lists apply to traffic as it enters an interface.
• Outbound—Outbound access lists apply to traffic as it exits an interface.