Cisco SA520-K9 Administration Guide - Page 111

Configuring MAC Filtering to Allow or Block Traffic, Configuring IP/MAC Binding to Prevent

Get Cisco SA520-K9 - SA 500 Series Security Appliances PDF manuals and user guides
UPC - 882658266744
View all Cisco SA520-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 111 highlights

Firewall Configuration Configuring Firewall Rules to Control Inbound and Outbound Traffic 4 • You can allow or block traffic from specified MAC addresses. For more information, see Configuring MAC Filtering to Allow or Block Traffic, page 119 • You can associate IP addresses with MAC addresses to prevent spoofing. For more information, see Configuring IP/MAC Binding to Prevent Spoofing, page 128 STEP 1 Click Firewall > Firewall > IPv4 Rules or IPv6 Rules, or for IPv4 rules, you can use the Getting Started (Advanced) page. In the Firewall and NAT Rules section, click Configure Firewall and NAT Rules. The Firewall Rules window opens. Any existing rules appear in the List of Available Firewall Rules table. For IPv4 rules, you can view the list of available rules by zone. Choose the source and destination from the From Zone and To Zone drop-down menu and click Display Rules. STEP 2 To add a rule, click Add. Other options: Click the Edit button to edit an entry. To delete an entry, check the box and then click Delete. To change the status of a rule, check the box and then click Enable or Disable. To select all entries, check the box in the first column of the table heading. The IPv4 Firewall Rules page includes the option to move a rule up, move a rule down, or move it to a specified location in the firewall rules list. For more information, see Prioritizing Firewall Rules, page 113. If you click Add or Edit, the Firewall Rules Configuration window opens. STEP 3 In the Firewall Rule Configuration area, enter the following information: • From Zone: Chose the source of the traffic that is covered by this rule. For an inbound rule, choose INSECURE (WAN) if the traffic is coming from the Internet or choose DMZ if the traffic is coming from a server on your DMZ. • To Zone: For an inbound rule, choose SECURE (LAN) if the traffic is going to the LAN, or choose DMZ if the traffic is going to a server on your DMZ. - If the From Zone is the WAN, the To Zone can be the public DMZ or secure LAN. - If the From Zone is the LAN, then the To Zone can be the public DMZ or insecure WAN. Cisco SA500 Series Security Appliances Administration Guide 111

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
Firewall Configuration
Configuring Firewall Rules to Control Inbound and Outbound Traffic
Cisco SA500 Series Security Appliances Administration Guide
111
4
•
You can allow or block traffic from specified MAC addresses. For more
information, see
Configuring MAC Filtering to Allow or Block Traffic,
page 119
•
You can associate IP addresses with MAC addresses to prevent spoofing.
For more information, see
Configuring IP/MAC Binding to Prevent
Spoofing, page 128
STEP 1
Click
Firewall
> Firewall > IPv4 Rules
or
IPv6 Rules
, or for IPv4 rules, you can use
the Getting Started (Advanced) page. In the
Firewall and NAT Rules
section, click
Configure Firewall and NAT Rules
.
The Firewall Rules window opens. Any existing rules appear in the List of Available
Firewall Rules table.
For IPv4 rules, you can view the list of available rules by zone. Choose the source
and destination from the
From Zone
and
To Zone
drop-down menu and click
Display Rules
.
STEP 2
To add a rule, click
Add
.
Other options:
Click the
Edit
button to edit an entry. To delete an entry, check the
box and then click
Delete
. To change the status of a rule, check the box and then
click
Enable
or
Disable
. To select all entries, check the box in the first column of
the table heading.
The IPv4 Firewall Rules page
includes the option to move a rule up, move a rule
down, or move it to a specified location in the firewall rules list. For more
information, see
Prioritizing Firewall Rules, page 113
.
If you click
Add
or
Edit
, the Firewall Rules Configuration window opens.
STEP 3
In the
Firewall Rule Configuration
area, enter the following information:
•
From Zone:
Chose the source of the traffic that is covered by this rule. For an
inbound rule, choose
INSECURE (WAN)
if the traffic is coming from the
Internet or choose
DMZ
if the traffic is coming from a server on your DMZ.
•
To Zone:
For an inbound rule, choose
SECURE (LAN)
if the traffic is going to
the LAN, or choose
DMZ
if the traffic is going to a server on your DMZ.
-
If the From Zone is the WAN, the To Zone can be the public DMZ or secure
LAN.
-
If the From Zone is the LAN, then the To Zone can be the public DMZ or
insecure WAN.