Access Control List Override; Adding An Extended Access Control List - Cisco Catalyst 6500 Series Configuration Manual
Catalyst 6500 series switch and
cisco 7600 series router firewall services
Hide thumbs
Also See for Catalyst 6500 Series:
- Software configuration manual (570 pages) ,
- Configuration note (212 pages) ,
- Installation manual (194 pages)
Table of Contents
Advertisement
Chapter 10
Controlling Network Access with Access Control Lists
Access Control List Override
When you download a per-user access control list (ACL), the permit/deny status of the access-group
access list is maintained unless you specifically change the permit/deny status so that the downloaded
per-user access list overrides the interface access list. If ACL override is enabled, user traffic is
permitted if it is permitted by the per-user access list, regardless of the permit status of interface access
list.
The access-group per-user-override command is implemented for the inbound ACLs only, not for the
Note
outbound ACLs.
To enable ACL override, enter the following command:
fwsm/context(config)# access-group
per-user-override
Adding an Extended Access Control List
An extended ACL is made up of one or more ACEs, in which you can specify the source and destination
addresses, and, depending on the ACE type, the protocol, the ports (for TCP or UDP), or the ICMP type
(for ICMP). You can identify all of these parameters within the access-list command, or you can use
object groups for each parameter. This section describes how to identify the parameters within the
command. To use object groups, see the
section on page
For TCP and UDP connections, you do not need to also apply an ACL on the destination interface to
allow returning traffic, because the FWSM allows all returning traffic for established connections. See
the
"Stateful Inspection Feature" section on page 1-5
such as ICMP, however, you either need ACLs to allow ICMP in both directions (by applying ACLs to
the source and destination interfaces), or you need to enable the ICMP inspection engine. (See the
"ICMP Inspection Engine" section on page
as stateful connections. For transparent mode, you can allow protocols with an extended ACL that are
otherwise blocked by a routed mode FWSM, including BGP, DHCP, and multicast streams. Because
these protocols do not have sessions on the FWSM to allow returning traffic, these protocols also require
ACLs on both interfaces.
You can apply only one ACL of each type (extended and EtherType) to each direction of an interface.
You can apply the same ACLs on multiple interfaces.
If you change the ACL configuration, and you do not want to wait for existing connections to time out
Note
before the new ACL information is used, you can clear the translation table using the clear xlate
command. However, clearing the translation table disconnects all current connections.
OL-6392-01
10-18.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
access-list {
}
in | out
interface
"Simplifying Access Control Lists with Object Grouping"
for more information. For connectionless protocols
13-10.) The ICMP inspection engine treats ICMP sessions
Adding an Extended Access Control List
interface_name
10-13
Advertisement
Table of Contents
Troubleshooting
