Cisco ASA Series Cli Configuration Manual page 990

Configuring Access Rules
Detailed Steps
Command
access-group access_list
{{in | out} interface interface_name
[per-user-override | control-plane] |
global}
Example:
hostname(config)# access-group acl_out in
interface outside
Examples
The following example shows how to use the access-group command:
hostname(config)# access-list acl_out permit tcp any host 209.165.201.3 eq 80
hostname(config)# access-group acl_out in interface outside
The access-list command lets any host access the global address using port 80. The access-group
command specifies that the access-list command applies to traffic entering the outside interface.
•
Cisco ASA Series CLI Configuration Guide
1-8
Purpose
Binds an access list to an interface or applies it globally.
Specify the extended or EtherType access list name. You can configure one
access-group command per access list type per interface. You cannot
reference empty access lists or access lists that contain only a remark.
For an interface-specific rule:
•
The in keyword applies the access list to inbound traffic. The out
keyword applies the access list to the outbound traffic.
•
Specify the interface name.
•
The per-user-override keyword (for inbound access lists only) allows
dynamic user access lists that are downloaded for user authorization to
override the access list assigned to the interface. For example, if the
interface access list denies all traffic from 10.0.0.0, but the dynamic
access list permits all traffic from 10.0.0.0, then the dynamic access
list overrides the interface access list for that user.
For VPN remote access traffic, the behavior depends on whether there
is a vpn-filter applied in the group policy and whether you set the
per-user-override option:
–
No per-user-override, no vpn-filter—Traffic is matched against
the interface ACL (per the default no sysopt connection
permit-vpn command).
–
No per-user-override, vpn-filter—Traffic is matched first
against the interface ACL, then against the VPN filter.
–
per-user-override, vpn-filter—Traffic is matched against the
VPN filter only.
See the "Configuring RADIUS Authorization" section on page 1-17
for more information about per-user access lists. See also the
"Per-User Access List Guidelines" section on page
•
The control-plane keyword specifies if the rule is for to-the-box
traffic.
For a global rule, specify the global keyword to apply the
access list to the inbound direction of all interfaces.
Chapter 1 Configuring Access Rules
1-7.