Cisco 500 Series, Configuration Manual

Page: 303 / 1140

16-9
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 16 Identifying Traffic with Access Lists
Adding an EtherType Access List
The security appliance receives trunk port (Cisco proprietary) BPDUs. Trunk BPDUs have VLAN
information inside the payload, so the security appliance modifies the payload with the outgoing VLAN
if you allow BPDUs.
Note
If you use failover, you must allow BPDUs on both interfaces with an EtherType access list to avoid
bridging loops.
Implicit Permit of IP and ARPs Only
IPv4 traffic is allowed through the transparent firewall automatically from a higher security interface to
a lower security interface, without an access list. ARPs are allowed through the transparent firewall in
both directions without an access list. ARP traffic can be controlled by ARP inspection.
However, to allow any traffic with EtherTypes other than IPv4 and ARP, you need to apply an EtherType
access list, even from a high security to a low security interface.
Because EtherTypes are connectionless, you need to apply the access list to both interfaces if you want
traffic to pass in both directions.
Implicit and Explicit Deny ACE at the End of an Access List
For EtherType access lists, the implicit deny at the end of the access list does not affect IP traffic or
ARPs; for example, if you allow EtherType 8037, the implicit deny at the end of the access list does not
now block any IP traffic that you previously allowed with an extended access list (or implicitly allowed
from a high security interface to a low security interface). However, if you
explicitly deny all traffic with
an EtherType ACE, then IP and ARP traffic is denied.
IPv6 Unsupported
EtherType ACEs do not allow IPv6 traffic, even if you specify the IPv6 EtherType.
Using Extended and EtherType Access Lists on the Same Interface
You can apply only one access list of each type (extended and EtherType) to each direction of an
interface. You can also apply the same access lists on multiple interfaces.
Allowing MPLS
If you allow MPLS, ensure that Label Distribution Protocol and Tag Distribution Protocol TCP
connections are established through the security appliance by configuring both MPLS routers connected
to the security appliance to use the IP address on the security appliance interface as the router-id for LDP
or TDP sessions. (LDP and TDP allow MPLS routers to negotiate the labels (addresses) used to forward
packets.)
On Cisco IOS routers, enter the appropriate command for your protocol, LDP or TDP. The interface is
the interface connected to the security appliance.
hostname(config)# mpls ldp router-id interface force
Or
hostname(config)# tag-switching tdp router-id interface force