Adding An Ethertype Access List - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 16 Identifying Traffic with Access Lists

Adding an EtherType Access List

If you want to restrict access to only some hosts, then enter a limited permit ACE. By default, all other
traffic is denied unless explicitly permitted.
hostname(config)# access-list ACL_IN extended permit ip 192.168.1.0 255.255.255.0
209.165.201.0 255.255.255.224
The following access list restricts all hosts (on the interface to which you apply the access list) from
accessing a website at address 209.165.201.29. All other traffic is allowed.
hostname(config)# access-list ACL_IN extended deny tcp any host 209.165.201.29 eq www
hostname(config)# access-list ACL_IN extended permit ip any any
Adding an EtherType Access List
Transparent firewall mode only
An EtherType ACE controls any EtherType identified by a 16-bit hexadecimal number. You can identify
some types by a keyword for convenience. If you add an ACE to an EtherType access list that specifically
denies all traffic, then that ACE also denies IP and ARP traffic, even if you have an extended access list
that allows IP traffic. The implicit deny at the end of all access lists allows IP and ARP through.
EtherType ACEs do not allow IPv6 traffic, even if you specify the IPv6 EtherType.
Because EtherTypes are connectionless, you need to apply the access list to both interfaces if you want
traffic to pass in both directions. For example, you can permit or deny bridge protocol data units. By
default, all BPDUs are denied. The security appliance receives trunk port (Cisco proprietary) BPDUs
because security appliance ports are trunk ports. Trunk BPDUs have VLAN information inside the
payload, so the security appliance modifies the payload with the outgoing VLAN if you allow BPDUs.
If you use failover, you must allow BPDUs on both interfaces with an EtherType access list to avoid
bridging loops.
If you allow MPLS, ensure that Label Distribution Protocol and Tag Distribution Protocol TCP
connections are established through the security appliance by configuring both MPLS routers connected
to the security appliance to use the IP address on the security appliance interface as the router-id for LDP
or TDP sessions. (LDP and TDP allow MPLS routers to negotiate the labels (addresses) used to forward
packets.)
On Cisco IOS routers, enter the appropriate command for your protocol, LDP or TDP. The interface is
the interface connected to the security appliance.
hostname(config)# mpls ldp router-id interface force
Or
hostname(config)# tag-switching tdp router-id interface force
You can apply only one access list of each type (extended and EtherType) to each direction of an
interface. You can also apply the same access lists on multiple interfaces.
To add an EtherType ACE, enter the following command:
hostname(config)# access-list access_list_name ethertype {permit | deny} {ipx | bpdu |
mpls-unicast | mpls-multicast | any | hex_number}
The hex_number is any EtherType that can be identified by a 16-bit hexadecimal number greater than or
equal to 0x600. See RFC 1700, "Assigned Numbers," at http://www.ietf.org/rfc/rfc1700.txt for a list of
EtherTypes.
Cisco Security Appliance Command Line Configuration Guide
16-8
OL-10088-01