Adding An Ethertype Access List; Ethertype Access List Overview; Supported Ethertypes; Implicit Permit Of Ip And Arps Only - Cisco PIX 500 Series Configuration Manual

Adding an EtherType Access List

The following sample access list prevents hosts on 192.168.1.0/24 from accessing the 209.165.201.0/27
network. All other addresses are permitted.
hostname(config)# access-list ACL_IN extended deny tcp 192.168.1.0 255.255.255.0
209.165.201.0 255.255.255.224
hostname(config)# access-list ACL_IN extended permit ip any any
If you want to restrict access to only some hosts, then enter a limited permit ACE. By default, all other
traffic is denied unless explicitly permitted.
hostname(config)# access-list ACL_IN extended permit ip 192.168.1.0 255.255.255.0
209.165.201.0 255.255.255.224
The following access list restricts all hosts (on the interface to which you apply the access list) from
accessing a website at address 209.165.201.29. All other traffic is allowed.
hostname(config)# access-list ACL_IN extended deny tcp any host 209.165.201.29 eq www
hostname(config)# access-list ACL_IN extended permit ip any any
Adding an EtherType Access List
Transparent firewall mode only
This section describes how to add an EtherType access list, and includes the following sections:
•
•

EtherType Access List Overview

An EtherType access list is made up of one or more ACEs that specify an EtherType. This section
includes the following topics:
•
•
•
•
•
•

Supported EtherTypes

An EtherType ACE controls any EtherType identified by a 16-bit hexadecimal number.
EtherType access lists support Ethernet V2 frames.
802.3-formatted frames are not handled by the access list because they use a length field as opposed to
a type field.
BPDUs, which are handled by the access list, are the only exception: they are SNAP-encapsulated, and
the security appliance is designed to specifically handle BPDUs.
Cisco Security Appliance Command Line Configuration Guide
16-8
EtherType Access List Overview, page 16-8
Adding an EtherType ACE, page 16-10
Supported EtherTypes, page 16-8
Implicit Permit of IP and ARPs Only, page 16-9
Implicit and Explicit Deny ACE at the End of an Access List, page 16-9
IPv6 Unsupported, page 16-9
Using Extended and EtherType Access Lists on the Same Interface, page 16-9
Allowing MPLS, page 16-9
Chapter 16 Identifying Traffic with Access Lists
OL-12172-03