Cisco PIX 500 Series Configuration Manual page 13

Identifying Traffic with Access Lists
16
C H A P T E R
OL-12172-03
How Data Moves Through the Transparent Firewall
An Inside User Visits a Web Server
An Inside User Visits a Web Server Using NAT
An Outside User Visits a Web Server on the Inside Network
An Outside User Attempts to Access an Inside Host
Access List Overview
16-1
Access List Types
16-2
Access Control Entry Order
Access Control Implicit Deny
IP Addresses Used for Access Lists When You Use NAT
Adding an Extended Access List
Extended Access List Overview
Allowing Broadcast and Multicast Traffic through the Transparent Firewall
Adding an Extended ACE
Adding an EtherType Access List
EtherType Access List Overview
Supported EtherTypes
Implicit Permit of IP and ARPs Only
Implicit and Explicit Deny ACE at the End of an Access List
IPv6 Unsupported
Using Extended and EtherType Access Lists on the Same Interface
Allowing MPLS
Adding an EtherType ACE
Adding a Standard Access List
Adding a Webtype Access List
Simplifying Access Lists with Object Grouping
How Object Grouping Works
Adding Object Groups
Adding a Protocol Object Group
Adding a Network Object Group
Adding a Service Object Group
Adding an ICMP Type Object Group
Nesting Object Groups
Using Object Groups with an Access List
Displaying Object Groups
Removing Object Groups
Adding Remarks to Access Lists
15-12
16-1
16-2
16-3
16-5
16-5
16-6
16-8
16-8
16-8
16-9
16-9
16-9
16-10
16-10
16-11
16-11
16-11
16-12
16-12
16-13
16-13
16-14
16-15
16-16
16-17
16-17
16-17
Cisco Security Appliance Command Line Configuration Guide
15-11
15-13
15-14
15-15
16-3
16-6
16-9
16-9
Contents
xiii