Extended Access Rules For Returning Traffic; Allowing Broadcast And Multicast Traffic Through The Transparent Firewall Using Access Rules; Management Access Rules - Cisco ASA Series Configuration Manual

Chapter 4 Access Rules

Extended Access Rules for Returning Traffic

For TCP and UDP connections for both routed and transparent mode, you do not need an access rule to
allow returning traffic because the ASA allows all returning traffic for established, bidirectional
connections.
For connectionless protocols such as ICMP, however, the ASA establishes unidirectional sessions, so
you either need access rules to allow ICMP in both directions (by applying ACLs to the source and
destination interfaces), or you need to enable the ICMP inspection engine. The ICMP inspection engine
treats ICMP sessions as bidirectional connections. To control ping, specify echo-reply (0) (ASA to host)
or echo (8) (host to ASA).

Allowing Broadcast and Multicast Traffic through the Transparent Firewall Using Access Rules

In routed firewall mode, broadcast and multicast traffic is blocked even if you allow it in an access rule,
including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay).
Transparent firewall mode can allow any IP traffic through.
Because these special types of traffic are connectionless, you need to apply an access rule to both
Note
interfaces, so returning traffic is allowed through.
The following table lists common traffic types that you can allow through the transparent firewall.
Table 4-1
Traffic Type
DHCP
EIGRP
OSPF
Multicast streams The UDP ports vary depending
RIP (v1 or v2)

Management Access Rules

You can configure access rules that control management traffic destined to the ASA. Access control rules
for to-the-box management traffic (defined by such commands as http, ssh, or telnet) have higher
precedence than a management access rule applied with the control-plane option. Therefore, such
permitted management traffic will be allowed to come in even if explicitly denied by the to-the-box ACL.
Alternatively, you can use ICMP rules to control ICMP traffic to the device. Use regular extended access
rules to control ICMP traffic through the device.
Transparent Firewall Special Traffic
Protocol or Port
UDP ports 67 and 68
Protocol 88
Protocol 89
on the application.
UDP port 520
Notes
If you enable the DHCP server, then the ASA
does not pass DHCP packets.
—
—
Multicast streams are always destined to a
Class D address (224.0.0.0 to 239.x.x.x).
—
Cisco ASA Series Firewall CLI Configuration Guide
Controlling Network Access
4-5