Cisco Asdm 7 User Guide

 
7-7
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Licensing Requirements for Access Rules
Access Rules for Returning Traffic
Because EtherTypes are connectionless, you need to apply the rule to both interfaces if you want traffic 
to pass in both directions.
Allowing MPLS
If you allow MPLS, ensure that Label Distribution Protocol and Tag Distribution Protocol TCP 
connections are established through the ASA by configuring both MPLS routers connected to...

 
7-8
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Configuring Access Rules
This section includes the following topics:
Adding an Access Rule, page 7-8
Adding an EtherType Rule (Transparent Mode Only), page 7-9
Configuring Management Access Rules, page 7-10
Advanced Access Rule Configuration, page 7-11
Configuring HTTP Redirect, page 7-12
Configuring Transactional Commit Model, page 7-13
Adding an Access Rule
To apply an access...

 
7-9
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Step 9Select the service type.
Step 10(Optional) To add a time range to your access rule that specifies when traffic can be allowed or denied, 
click More Options to expand the list.
a.To the right of the Time Range drop down list, click the browse button. 
The Browse Time Range dialog box appears.
b.Click Add.
The Add Time Range dialog box appears.
c.In the Time Range Name...

 
7-10
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Step 5In the Action field, click one of the following radio buttons next to the desired action:
Permit—Permits access if the conditions are matched.
Deny—Denies access if the conditions are matched.
Step 6In the EtherType field, choose an EtherType value from the drop-down list.
Step 7(Optional) In the Description field, add a test description about the rule.
The description...

 
7-11
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Step 8(Optional) Logging is enabled by default. You can disable logging by unchecking the check box, or you 
can change the logging level from the drop-down list. The default logging level is Informational.
Step 9(Optional) To add a source service (TCP, UDP, and TCP-UDP only) and a time range to your access rule 
that specifies when traffic can be allowed or denied, click More...

 
7-12
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Alert Interval—The amount of time (1-3600 seconds) between system log messages (number 
106101) that identify that the maximum number of deny flows was reached. The default is 300 
seconds.
Per User Override table—Specifies the state of the per user override feature. If the per user override 
feature is enabled on the inbound access rule, the access rule provided by a RADIUS...

 
7-13
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
The Configuration > Device Management > Advanced > HTTP Redirect > Edit pane lets you change the 
HTTP redirect setting of an interface or the port from which it redirects HTTP connections. Select the 
interface in the table and click Edit. You can also double-click an interface. The Edit HTTP/HTTPS 
Settings dialog box opens.
Edit HTTP/HTTPS Settings
The Edit HTTP/HTTPS...

 
7-14
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Feature History for Access Rules
Feature History for Access Rules
Ta b l e 7 - 2 lists each feature change and the platform release in which it was implemented. ASDM is 
backwards-compatible with multiple platform releases, so the specific ASDM release in which support 
was added is not listed.
Table 7-2 Feature History for Access Rules
Feature NamePlatform 
Releases Feature Information
Interface access...

 
7-15
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Feature History for Access Rules
Extended ACLand object enhancement to filter 
ICMP traffic by ICMP code9.0(1) ICMP traffic can now be permitted/denied based on ICMP 
code.
We introduced or modified the following screens:
Configuration > Firewall > Objects > Service 
Objects/Groups
Configuration > Firewall > Access Rule 
Transactional Commit Model on Rule Engine 
for Access groups9.1(5) When enabled, a...

 
7-16
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Feature History for Access Rules