Adding An Ethertype Access List; Supported Ethertypes; Apply Access Lists In Both Directions; Implicit Deny At The End Of An Access List Does Not Affect Ip Or Arp Traffic - Cisco 7604 Configuration Manual
Catalyst 6500 series switch and cisco 7600 series router firewall services module configuration guide using the cli
Hide thumbs
Also See for 7604:
- Configuration manual (1011 pages) ,
- Installation manual (324 pages) ,
- User manual (98 pages)
Table of Contents
Advertisement
Chapter 13
Identifying Traffic with Access Lists
hostname(config)# access-list ACL_IN extended deny tcp any host 209.165.201.29 eq www
hostname(config)# access-list ACL_IN extended permit ip any any
Adding an EtherType Access List
Transparent firewall mode only
An EtherType access list is made up of one or more ACEs that specify an EtherType. This section
includes the following topics:
•
•
•
•
•
Supported EtherTypes
An EtherType ACE controls any EtherType identified by a 16-bit hexadecimal number.
EtherType access lists support Ethernet V2 frames.
802.3-formatted frames are not handled by the access list because they use a length field as opposed to
a type field.
BPDUs, which are handled by the access list, are the only exception: they are SNAP-encapsulated, and
the FWSM is designed to specifically handle BPDUs.
The FWSM receives trunk port (Cisco proprietary) BPDUs because FWSM ports are trunk ports. Trunk
BPDUs have VLAN information inside the payload, so the FWSM modifies the payload with the
outgoing VLAN if you allow BPDUs.
If you use failover, you must allow BPDUs on both interfaces with an EtherType access list to avoid
Note
bridging loops.
Apply Access Lists in Both Directions
Because EtherTypes are connectionless, you need to apply the access list to both interfaces if you want
traffic to pass in both directions.
Implicit Deny at the End of an Access List Does Not Affect IP or ARP Traffic
For EtherType access lists, the implicit deny at the end of the access list does not affect IPv4 traffic or
ARPs; for example, if you allow EtherType 8037, the implicit deny at the end of the access list does not
now block any IP traffic that you previously allowed with an extended access list. IPv4 and ARP traffic
cannot be controlled with an EtherType access list.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Supported EtherTypes, page 13-9
Apply Access Lists in Both Directions, page 13-9
Implicit Deny at the End of an Access List Does Not Affect IP or ARP Traffic, page 13-9
Using Extended and EtherType Access Lists on the Same Interface, page 13-10
Allowing MPLS, page 13-10
Adding an EtherType Access List
13-9
- Quick Links:
- C H a P T E...
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
