Cisco Systems Information About EtherType Rules

6-6
Cisco ASA Series Firewall CLI Configuration Guide
Chapter6 Configuring Access Rules
Information About Access Rules
Table 6 -1 lists common traffic types that you can allow through the transparent firewall.
Management Access Rules
You can configure access rules that control management traffic destined to the ASA. Access control rules
for to-the-box management traffic (defined by such commands as http, ssh, or telnet) have higher
precedence than an management access rule applied with the control-plane option. Therefore, such
permitted management traffic will be allowed to come in even if explicitly denied by the to-the-box ACL.
Information About EtherType Rules
This section describes EtherType rules and includes the following topics:
•Supported EtherTypes and Other Traffic, page6-6
•Access Rules for Returning Traffic, page6-7
•Allowing MPLS, page6-7
Supported EtherTypes and Other Traffic
An EtherType rule controls the following:
•EtherType identified by a 16-bit hexadecimal number, including common types IPX and MPLS
unicast or multicast.
•Ethernet V2 frames.
•BPDUs, which are permitted by default. BPDUs are SNAP-encapsulated, and the ASA is designed
to specifically handle BPDUs.
•Trunk port (Cisco proprietary) BPDUs. Trunk BPDUs have VLAN information inside the payload,
so the ASA modifies the payload with the outgoing VLAN if you allow BPDUs.
•IS-IS.
The following types of traffic are not supported:
•802.3-formatted frames—These frames are not handled by the rule because they use a length field
as opposed to a type field.
Table6-1 Transparent Firewall Special Traffic
Traffic Type Protocol or Port Notes
DHCP UDP ports 67 and 68 If you enable the DHCP server, then the ASA
does not pass DHCP packets.
EIGRP Protocol 88 —
OSPF Protocol 89 —
Multicast streams The UDP ports vary depending
on the application.
Multicast streams are always destined to a
Class D address (224.0.0.0 to 239.x.x.x).
RIP (v1 or v2) UDP port 520 —