Cisco ASA 5508-X, Руководство по настройке

Страница: 40 / 428

3-16
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 3 Access Control Lists
Configure ACLs
For an explanation of keywords not explained here, see Add a Webtype ACE for URL Matching,
page 3-14 . Keywords and arguments specific to this type of ACE include the following:
• tcp —The TCP protocol. Webtype ACLs match TCP traffic only.
•
Destination Address—The dest_address_argument specifies the IP address to which the packet is
being sent:
– host ip_address —Specifies an IPv4 host address.
–
dest_ip_address mask —Specifies an IPv4 network address and subnet mask, such as
10.100.10.0 255.255.255.0.
– ipv6-address / prefix-length —Specifies an IPv6 host or network address and prefix.
–
any , any4 , and any6 — any specifies both IPv4 and IPv6 traffic; any4 specifies IPv4 traffic only;
and any6 specifies IPv6 traffic only.
• operator port —The destination port. If you do not specify ports, all ports are matched. The operator
can be one of the following:
–
lt —less than
– gt —greater than
–
eq —equal to
– neq —not equal to
–
range —an inclusive range of values. When you use this operator, specify two port numbers, for
example:
range 100 200
The port can be the integer or name of a TCP port.
Examples for Webtype ACLs
The following example shows how to deny access to a specific company URL:
hostname(config)# access-list acl_company webtype deny url http://*.example.com
The following example shows how to deny access to a specific web page:
hostname(config)# access-list acl_file webtype deny url
https://www.example.com/dir/file.html
The following example shows how to deny HTTP access to any URL on a specific server through port
8080:
hostname(config)# access-list acl_company webtype deny url http://my-server:8080/*
The following examples show how to use wildcards in webtype ACLs.
•
The following example matches URLs such as http://www.example.com/layouts/1033:
access-list VPN-Group webtype permit url http://www.example.com/*
•
The following example matches URLs such as http://www.example.com/ and
http://www.example.net/:
access-list test webtype permit url http://www.example.*