Firewall
Configuring the Firewall Access Rules to Control Inbound and Outbound Traffic
Cisco ISA500 Series Integrated Security Appliance Administrator Guide
185
6
Configuring a Firewall Access Rule to Allow the Multicast
Traffic
By default, the multicast traffic from any zone to any zone is blocked by the default
firewall access rules. To enable the multicast, you first need to uncheck the
Block
Multicast Packets
box in the
Firewall -> Attack Protection
page and then
manually create the firewall rules to allow multicast forwarding from a specific
zone to other zones. The security appliance predefines a multicast address for this
purpose.
For example, IGMP Proxy can be active from WAN to LAN. When you enable IGMP
Proxy and want to receive the multicast packets from WAN to LAN, you need to
uncheck the
Block Multicast Packets
box in the
Firewall -> Attack Protection
page, and create a firewall access rule to permit the multicast traffic from WAN to
LAN.
This section provides a configuration example about how to create a WAN-to-LAN
access rule to permit the multicast traffic by using the predefined multicast
address.
STEP 1
Click
Firewall -> ACL Rules -> Rule
.
The ACL Rules window opens.
STEP 2
To add a new access rule, click
Add
.
After you click Add, the Rule - Add/Edit window opens.
STEP 3
Enter the following information:
•
Enable:
Click
On
to enable the fireall access rule.
•
From Zone:
Choose
WAN
as the source zone of the traffic.
•
To Zone:
Choose
LAN
as the destination zone of the traffic.
•
Services:
Choose
ANY
for this rule.
•
Source Address:
Choose
ANY
as the source address for this rule.
•
Destination Address:
Choose the existing address called “
Multicast
” as the
destination address for this rule. The Multicast address object is predefined
on your security appliance for creating multicast firewall access rules.
•
Schedule:
Choose
Always On
for this rule.
•
Log:
Click
Off
for this rule. We recommend that you disable the Log feature
for a multicast firewall access rule.
