Cisco 500 Series, Руководство по настройке

Страница: 355 / 1140

C H A P T E R
18-1
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
18
Permitting or Denying Network Access
This chapter describes how to control network access through the security appliance using access lists.
To create an extended access lists or an EtherType access list, see
Chapter 16, “Identifying Traffic with
Access Lists.”
Note You use ACLs to control network access in both routed and transparent firewall modes. In transparent
mode, you can use both extended ACLs (for Layer 3 traffic) and EtherType ACLs (for Layer 2 traffic).
To access the security appliance interface for management access, you do not need an access list
allowing the host IP address. You only need to configure management access according to
Chapter 40,
“Managing System Access.”
This chapter includes the following sections:
•
Inbound and Outbound Access List Overview, page 18-1
• Applying an Access List to an Interface, page 18-2
Inbound and Outbound Access List Overview
By default, all traffic from a higher-security interface to a lower-security interface is allowed. Access
lists let you either allow traffic from lower-security interfaces, or restrict traffic from higher-security
interfaces.
The security appliance supports two types of access lists:
• Inbound—Inbound access lists apply to traffic as it enters an interface.
•
Outbound—Outbound access lists apply to traffic as it exits an interface.
Note
“Inbound” and “outbound” refer to the application of an access list on an interface, either to traffic
entering the security appliance on an interface or traffic exiting the security appliance on an interface.
These terms do not refer to the movement of traffic from a lower security interface to a higher security
interface, commonly known as inbound, or from a higher to lower interface, commonly known as
outbound.
An outbound access list is useful, for example, if you want to allow only certain hosts on the inside
networks to access a web server on the outside network. Rather than creating multiple inbound access
lists to restrict access, you can create a single outbound access list that allows only the specified hosts