Cisco 7604 Configuration Guide - Page 228

Access List Overview Chapter 13 Identifying Traffic with Access Lists Access List Types Table 13-1 lists the types of access lists and some common uses for them. Table 13-1 Access List Types and Common Uses Access List Use Access List Type Description Control network access for IP traffic (routed and transparent mode) Extended The FWSM does not allow any traffic unless it is explicitly permitted by an extended access list. Note To access the FWSM interface for management access, you do not also need an access list allowing the host IP address. You only need to configure management access according to Chapter 23, "Configuring Management Access." Identify traffic for AAA rules Extended AAA rules use access lists to identify traffic. Control network access for IP traffic for a given user Extended, downloaded from a AAA server per user You can configure the RADIUS server to download a dynamic access list to be applied to the user, or the server can send the name of an access list that you already configured on the FWSM. Identify addresses for NAT (policy NAT Extended and NAT exemption) Policy NAT lets you identify local traffic for address translation by specifying the source and destination addresses in an extended access list. Establish VPN access Extended You can use an extended access list in VPN commands. Identify traffic in a traffic class map for Extended Modular Policy EtherType Access lists can be used to identify traffic in a class map, which is used for features that support Modular Policy Framework. Features that support Modular Policy Framework include TCP and general connection settings, and inspection. For transparent firewall mode, control network access for non-IP traffic EtherType You can configure an access list that controls traffic based on its EtherType. Identify OSPF route redistribution Standard Standard access lists include only the destination address. You can use a standard access list to control the redistribution of OSPF routes. Access Control Entry Order An access list is made up of one or more Access Control Entries. Depending on the access list type, you can specify the source and destination addresses, the protocol, the ports (for TCP or UDP), the ICMP type (for ICMP), or the EtherType. Each ACE that you enter for a given access list name is appended to the end of the access list unless you specify the line number in the ACE (extended access lists only). The order of ACEs is important. When the FWSM decides whether to forward or drop a packet, the FWSM tests the packet against each ACE in the order in which the entries are listed. After a match is found, no more ACEs are checked. For example, if you create an ACE at the beginning of an access list that explicitly permits all traffic, no further statements are ever checked. You can disable an ACE by making it inactive. 13-2 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01