6-5
Cisco ASA Series Firewall CLI Configuration Guide
Chapter6 Configuring Access Rules
Information About Access Rules
Firewall Mode Guidelines
Supported in routed and transparent firewall mode.
IPv6 Guidelines
Supports IPv6.
Additional Guidelines and Limitations
Evaluate the following alternatives before using the transactional commit model:
•While using large rules, try to optimize the number of rules by using the Object Group Search setting
in Advanced Access Rule Configuration settings.
•Perform an incremental rule update instead of a bulk rule update. If a bulk update is necessary
perform the bulk update during the maintenance window, when traffic is low.
Information About Extended Access Rules
This section describes information about extended access rules and includes the following topics:
•Access Rules for Returning Traffic, page6-5
•Allowing Broadcast and Multicast Traffic through the Transparent Firewall Using Access Rules,
page 6-5
•Management Access Rules, page 6-6

Access Rules for Returning Traffic

For TCP and UDP connections for both routed and transparent mode, you do not need an access rule to
allow returning traffic because the ASA allows all returning traffic for established, bidirectional
connections.
For connectionless protocols such as ICMP, however, the ASA establishes unidirectional sessions, so
you either need access rules to allow ICMP in both directions (by applying ACLs to the source and
destination interfaces), or you need to enable the ICMP inspection engine. The ICMP inspection engine
treats ICMP sessions as bidirectional connections. To control ping, specify echo-reply (0) (ASA to host)
or echo (8) (host to ASA).

Allowing Broadcast and Multicast Traffic through the Transparent Firewall Using Access Rules

In routed firewall mode, broadcast and multicast traffic is blocked even if you allow it in an access rule,
including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay).
Transparent firewall mode can allow any IP traffic through.
Note Because these special types of traffic are connectionless, you need to apply an access rule to both
interfaces, so returning traffic is allowed through.