Cisco Asdm 7 User Guide

							 
7-7
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Licensing Requirements for Access Rules
Access Rules for Returning Traffic
Because EtherTypes are connectionless, you need to apply the rule to both interfaces if you want traffic 
to pass in both directions.
Allowing MPLS
If you allow MPLS, ensure that Label Distribution Protocol and Tag Distribution Protocol TCP 
connections are established through the ASA by configuring both MPLS routers connected to the ASA 
to use the IP address on the ASA interface as the router-id for LDP or TDP sessions. (LDP and TDP 
allow MPLS routers to negotiate the labels (addresses) used to forward packets.)
On Cisco IOS routers, enter the appropriate command for your protocol, LDP or TDP. The interface is 
the interface connected to the ASA.
ciscoasa(config)# mpls ldp router-id interface force
Or
ciscoasa(config)# tag-switching tdp router-id interface force
Licensing Requirements for Access Rules
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
Supported in single and multiple context mode.
Firewall Mode Guidelines
Supported in routed and transparent firewall modes.
IPv6 Guidelines
Supports IPv6. (9.0 and later) The source and destination addresses can include any mix of IPv4 and IPv6 
addresses. For pre-9.0 versions, you must create a separate IPv6 access rule.
Default Settings
See the “Implicit Permits” section on page 7-2. Model License Requirement
All models Base License. 
						

							 
7-8
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Configuring Access Rules
This section includes the following topics:
Adding an Access Rule, page 7-8
Adding an EtherType Rule (Transparent Mode Only), page 7-9
Configuring Management Access Rules, page 7-10
Advanced Access Rule Configuration, page 7-11
Configuring HTTP Redirect, page 7-12
Configuring Transactional Commit Model, page 7-13
Adding an Access Rule
To apply an access rule, perform the following steps.
Detailed Steps
Step 1Choose Configuration > Firewall > Access Rules.
Step 2Click Add, and choose one of the following options:
The Add Access Rule dialog box appears.
Step 3From the Interface drop-down list, choose the interface on which to apply the rule. Choose Any to apply 
a global rule.
Step 4In the Action field, click one of the following radio buttons next to the desired action:
Permit—Permits access if the conditions are matched.
Deny—Denies access if the conditions are matched.
Step 5In the Source field, enter an IP address that specifies the network, interface IP, or any address from which 
traffic is permitted or denied to the specified destination. You may use either an IPv4 or IPv6 address.
For more information about enabling IPv6 on an interface, see the “Configuring IPv6 Addressing” 
section on page 13-18 in the general operations configuration guide.
Step 6In the User field, enter a user name or group to the ACL. Enter the user name in the format 
domain_NetBIOS_name\user_name. Enter the group name in the format 
domain_NetBIOS_name\group_name. 
You can configure access rules based on user names and user group names rather than through source IP 
addresses. The ASA applies the security policies based on an association of IP addresses to Windows 
Active Directory login information and reports events based on the mapped user names instead of 
network IP addresses.
See the “Configuring Identity-Based Security Policy” section on page 38-23 in the general operations 
configuration guide for more information. 
Step 7To browse for a user name or user group, click the ellipsis (...) button. The Browse User dialog box 
appears.
Step 8In the Destination field, enter an IP address that specifies the network, interface IP, any address to which 
traffic is permitted or denied from the source specified in the Source field. You may use either an IPv4 
or IPv6 address. 
						

							 
7-9
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Step 9Select the service type.
Step 10(Optional) To add a time range to your access rule that specifies when traffic can be allowed or denied, 
click More Options to expand the list.
a.To the right of the Time Range drop down list, click the browse button. 
The Browse Time Range dialog box appears.
b.Click Add.
The Add Time Range dialog box appears.
c.In the Time Range Name field, enter a time range name, with no spaces.
d.Choose the Start Time and the End Time.
e.To specify additional time constraints for the time range, such as specifying the days of the week or 
the recurring weekly interval in which the time range will be active, click Add, and choose the 
specifications.
f.Click OK to apply the optional time range specifications.
Step 11(Optional) In the Description field, add a text description about the access rule.
The description can contain multiple lines; however, each line can be no more than 100 characters in 
length.
Step 12(Optional) Logging is enabled by default. You can disable logging by unchecking the check box, or you 
can change the logging level from the drop-down list. The default logging level is Informational.
Step 13Click OK. The access rule appears with the newly configured access rules.
Step 14Click Apply to save the access rule to your configuration.
You can edit or delete a particular access rule by selecting the rule and then clicking Edit or Delete.
Adding an EtherType Rule (Transparent Mode Only) 
The EtherType Rules window shows access rules based on packet EtherTypes. EtherType rules are used 
to configure non-IP related traffic policies through the ASA when operating in transparent mode. In 
transparent mode, you can apply both extended and EtherType access rules to an interface. EtherType 
rules take precedence over the extended access rules.
For more information about EtherType rules, see the “Information About Access Rules” section on 
page 7-1.
To add an EtherType rule, perform the following steps:
Step 1Choose Configuration > Device Management > Management Access > EtherType Rules. 
Step 2Click Add.
The Add EtherType rules window appears.
Step 3(Optional) To specify the placement of the new EtherType rule, select an existing rule, and click Insert... 
to add the EtherType rule before the selected rule, or click Insert After... to add the EtherType rule after 
the selected rule. 
Step 4From the Interface drop-down list, choose the interface on which to apply the rule. Choose Any to apply 
a global rule. 
						

							 
7-10
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Step 5In the Action field, click one of the following radio buttons next to the desired action:
Permit—Permits access if the conditions are matched.
Deny—Denies access if the conditions are matched.
Step 6In the EtherType field, choose an EtherType value from the drop-down list.
Step 7(Optional) In the Description field, add a test description about the rule.
The description can contain multiple lines; however, each line can be no more than 100 characters in 
length.
Step 8(Optional) To specify the direction for this rule, click More Options to expand the list, and then specify 
the direction by clicking one of the following radio buttons:
In—Incoming traffic
Out—Outgoing traffic
Step 9Click OK.
Configuring Management Access Rules   
You can configure an interface ACL that supports access control for to-the-box management traffic from 
a specific peer (or set of peers) to the security appliance. One scenario in which this type of ACL would 
be useful is when you want to block IKE Denial of Service attacks.
To configure an extended ACL that permits or denies packets for to-the-box traffic, perform the 
following steps:
Step 1Choose Configuration > Device Management > Management Access > Management Access Rules. 
Step 2Click Add, and choose one of the following actions:
The Add Management Access Rule dialog box appears.
Step 3From the Interface drop-down list, choose an interface on which to apply the rule. Choose Any to apply 
a global rule.
Step 4In the Action field, click one of the following radio buttons to choose the action:
Permit—Permits access if the conditions are matched.
Deny—Denies access if the conditions are matched.
Step 5In the Source field, enter an IP address that specifies the network object group, interface IP, or any 
address from which traffic is permitted or denied. You may use either an IPv4 or IPv6 address. 
NoteIPv6 must be enabled on at least one interface before you can configure an extended ACL with 
an IPv6 address. For more information about enabling IPv6 on an interface, see the “Configuring 
IPv6 Addressing” section on page 13-18 in the general operations configuration guide.
Step 6In the Service field, add a service name for rule traffic, or click the ellipsis (...) to browse for a service.
Step 7(Optional) In the Description field, add a description for this management access rule.
The description can contain multiple lines; however, each line can be no more than 100 characters in 
length. 
						

							 
7-11
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Step 8(Optional) Logging is enabled by default. You can disable logging by unchecking the check box, or you 
can change the logging level from the drop-down list. The default logging level is Informational.
Step 9(Optional) To add a source service (TCP, UDP, and TCP-UDP only) and a time range to your access rule 
that specifies when traffic can be allowed or denied, click More Options to expand the list.If you want 
to turn off this Management Access Rule, uncheck Enable Rule.
Add a source service in the Source Service field, or click the ellipsis (...) to browse for a service. 
The destination service and source service must be the same. Copy and paste the destination Service 
field to the Source Service field.
To configure the logging interval (if you enable logging and choose a non-default setting), enter a 
value in seconds in the Logging Interval field.
To select a predefined time range for this rule, from the Time Range drop-down list, choose a time 
range; or click the ellipsis (...) to browse for a time range. You can also specify additional time 
constraints for the time range, such as specifying the days of the week or the recurring weekly 
interval in which the time range will be active.
Step 10Click OK. The dialog box closes, and the Management Access rule is added.
Step 11Click Apply. The rule is saved in the running configuration.
Advanced Access Rule Configuration
The Advanced Access Rule Configuration dialog box lets you to set global access rule logging options. 
When you enable logging, if a packet matches the access rule, the ASA creates a flow entry to track the 
number of packets received within a specific interval. The ASA generates a system log message at the 
first hit and at the end of each interval, identifying the total number of hits during the interval and 
reporting the time of the last hit. 
NoteThe ASApane displays the hit count information in the “last rule hit” row. To view the rule hit count and 
timestamp, choose Configuration > Firewall > Advanced > ACL Manager, and hover the mouse 
pointer over a cell in the ACL Manager table. 
At the end of each interval, the ASA resets the hit count to 0. If no packets match the access rule during 
an interval, the ASA deletes the flow entry.
A large number of flows can exist concurrently at any point of time. To prevent unlimited consumption 
of memory and CPU resources, the ASA places a limit on the number of concurrent deny flows; the limit 
is placed only on deny flows (and not permit flows) because they can indicate an attack. When the limit 
is reached, the ASA does not create a new deny flow until the existing flows expire. If someone initiates 
a denial of service attack, the ASA can create a very large number of deny flows in a very short period 
of time. Restricting the number of deny-flows prevents unlimited consumption of memory and CPU 
resources.
Prerequisites
These settings only apply if you enable the newer logging mechanism for the access rule.
Fields
Maximum Deny-flows—The maximum number of deny flows permitted before the ASA stops 
logging, between 1 and the default value. The default is 4096. 
						

							 
7-12
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
Alert Interval—The amount of time (1-3600 seconds) between system log messages (number 
106101) that identify that the maximum number of deny flows was reached. The default is 300 
seconds.
Per User Override table—Specifies the state of the per user override feature. If the per user override 
feature is enabled on the inbound access rule, the access rule provided by a RADIUS server replaces 
the access rule configured on that interface. If the per user override feature is disabled, the access 
rule provided by the RADIUS server is combined with the access rule configured on that interface. 
If the inbound access rule is not configured for the interface, per user override cannot be configured.
By default, VPN remote access traffic is not matched against interface ACLs. However, if you 
deselect the Enable inbound VPN sessions to bypass interface access lists setting on the 
Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection 
Profiles pane), the behavior depends on whether there is a VPN filter applied in the group policy 
(see the Configuration > Remote Access VPN > Network (Client) Access > Group Policies > 
Add/Edit > General > More Options > Filter field) and whether you set the Per User Override option:
–No Per User Override, no VPN filter —Traffic is matched against the interface ACL.
–No Per User Override, VPN filter —Traffic is matched first against the interface ACL, then 
against the VPN filter.
–Per User Override, VPN filter —Traffic is matched against the VPN filter only.
Object Group Search Setting—Reduces the amount of memory used to store service rules, but 
lengthens the amount of time to search for a matching access rule.
Access Rule Explosion
The security appliance allows you to turn off the expansion of access rules that contain certain object 
groups. When expansion is turned off, an object group search is used for lookup, which lowers the 
memory requirements for storing expanded rules but decreases the lookup performance. Because of the 
trade-off of performance for memory utilization, you can turn on and turn off the search.
To configure the option of turning off the expansion of access rules that contain s, perform the following 
steps:
Step 1Choose Configuration > Firewall > Access Rules.
Step 2Click the Advanced button.
Step 3Check the Enable Object Group Search Algorithm check box.
Configuring HTTP Redirect
The HTTP Redirect table displays each interface on the ASA, shows whether it is configured to redirect 
HTTP connections to HTTPS, and the port number from which it redirects those connections.
NoteTo redirect HTTP, the interface requires an ACL that permits HTTP. Otherwise, the interface cannot 
listen to the HTTP port. 
						

							 
7-13
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Guidelines and Limitations
The Configuration > Device Management > Advanced > HTTP Redirect > Edit pane lets you change the 
HTTP redirect setting of an interface or the port from which it redirects HTTP connections. Select the 
interface in the table and click Edit. You can also double-click an interface. The Edit HTTP/HTTPS 
Settings dialog box opens.
Edit HTTP/HTTPS Settings
The Edit HTTP/HTTPS Settings dialog box lets you change the HTTP redirect setting of an interface or 
the port number.
Fields
The Edit HTTP/HTTPS Settings dialog box includes the following fields:
Interface—Identifies the interface on which the ASA redirects or does not redirect HTTP requests 
to HTTPS.
Redirect HTTP to HTTPS—Check to redirect HTTP requests to HTTPS, or uncheck to not redirect 
HTTP requests to HTTPS.
HTTP Port—Identifies the port from which the interface redirects HTTP connections. By default it 
listens to port 80.
For more information about access rules, see the “Information About Access Rules” section on page 7-1.
Configuring Transactional Commit Model
The ASA allows you to enable the Transactional commit model on the rule engine for access groups. 
With this model, new rules will not take effect until the rules are compiled and stable. During 
compilation packets will continue to match the old rules, but the connections per second limit will 
remain unaffected. 
To enable the Transactional Commit Model, perform the following steps:
Step 1Choose Configuration > Device Management > Advanced > Rule Engine.
Step 2Check the Enable Transactional commit model on Rule engine for Access Groups check box.
Step 3Click Apply. 
						

							 
7-14
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Feature History for Access Rules
Feature History for Access Rules
Ta b l e 7 - 2 lists each feature change and the platform release in which it was implemented. ASDM is 
backwards-compatible with multiple platform releases, so the specific ASDM release in which support 
was added is not listed.
Table 7-2 Feature History for Access Rules
Feature NamePlatform 
Releases Feature Information
Interface access rules 7.0(1) Controlling network access through the ASA using ACLs.
We introduced the following screen: Configuration > 
Firewall > Access Rules.
Global access rules 8.3(1) Global access rules were introduced.
We modified the following screen: Configuration > Firewall 
> Access Rules.
Support for Identity Firewall 8.4(2) You can now use identity firewall users and groups for the 
source and destination. You can use an identity firewall 
ACL with access rules, AAA rules, and for VPN 
authentication.
EtherType ACL support for IS-IS traffic 8.4(5), 9.1(2) In transparent firewall mode, the ASA can now pass IS-IS 
traffic using an EtherType ACL.
We modified the following screen: Configuration > Device 
Management > Management Access > EtherType Rules.
Support for TrustSec 9.0(1) You can now use TrustSec security groups for the source 
and destination. You can use an identity firewall ACL with 
access rules.
Unified ACL for IPv4 and IPv6 9.0(1) ACLs now support IPv4 and IPv6 addresses. You can even 
specify a mix of IPv4 and IPv6 addresses for the source and 
destination. The any keyword was changed to represent 
IPv4 and IPv6 traffic. The any4 and any6 keywords were 
added to represent IPv4-only and IPv6-only traffic, 
respectively. The IPv6-specific ACLs are deprecated. 
Existing IPv6 ACLs are migrated to extended ACLs. See the 
release notes for more information about migration.
We modified the following screens:
Configuration > Firewall > Access Rules
Configuration > Remote Access VPN > Network (Client) 
Access > Group Policies > General > More Options  
						

							 
7-15
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Feature History for Access Rules
Extended ACLand object enhancement to filter 
ICMP traffic by ICMP code9.0(1) ICMP traffic can now be permitted/denied based on ICMP 
code.
We introduced or modified the following screens:
Configuration > Firewall > Objects > Service 
Objects/Groups
Configuration > Firewall > Access Rule 
Transactional Commit Model on Rule Engine 
for Access groups9.1(5) When enabled, a rule update is applied after the rule 
compilation is completed; without affecting the rule 
matching performance.
We introduced the following screen: Configuration > 
Device Management > Advanced > Rule Engine.
Table 7-2 Feature History for Access Rules (continued)
Feature NamePlatform 
Releases Feature Information 
						

							 
7-16
Cisco ASA Series Firewall ASDM Configuration Guide
 
Chapter 7      Configuring Access Rules
  Feature History for Access Rules