Cisco Systems Deploying a Client Firewall for Local Printer Support

69-27
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter69 General VPN Setup
ACL Manager
•Windows users whose firewall service must be started by the AnyConnect client (not started
automatically by the system) may experience a noticeable increase in the time it takes to establish a
VPN connection.
•On Mac computers, the AnyConnect client applies rules sequentially in the same order the ASA
applies them. Global rules should always be last.
•For third-party firewalls, traffic is passed only if both the AnyConnect client firewall and the
third-party firewall allow that traffic type. If the third-party firewall blocks a specify traffic type that
the AnyConnect client allows, the client blocks the traffic.
The following sections describe procedures on how to do this:
•Deploying a Client Firewall for Local Printer Support, page 69-27
•Tethered Devices Support, page69-28
Deploying a Client Firewall for Local Printer Support
The ASA supports the SSL VPN client firewall feature with ASA version 8.3(1) or later, and ASDM
version 6.3(1) or later. This section describes how to configure the client firewall to allow access to local
printers, and how to configure the client profile to use the firewall when the VPN connection fails.
Limitations and Restrictions of the Client Firewall
The following limitations and restrictions apply to using the client firewall to restrict local LAN access:
•Due to limitations of the OS, the client firewall policy on computers running Windows XP is
enforced for inbound traffic only. Outbound rules and bidirectional rules are ignored. This would
include firewall rules such as 'permit ip any any'.
•Host Scan and some third-party firewalls can interfere with the firewall.
•Because the ASA does not support IPv6 addresses for split tunneling, the client firewall does not
support IPv6 devices on the local network.
Table69-1 clarifies what direction of traffic is affected by the source and destination port settings:
Table69-1 Source and Destination Ports and Traffic Direction Affected
Example ACL Rules for Local Printing
Table69-2 shows example ACL rules for local printing:
.
Source Port Destination Port Traffic Direction Affected
Specific port number Specific port number Inbound and outbound
A range or 'All' (value of 0) A range or 'All' (value of 0) Inbound and outbound
Specific port number A range or 'All' (value of 0) Inbound only
A range or 'All' (value of 0) Specific port number Outbound only
Table69-2 Example ACL Rules for Local Printing
Description Permission Interface Protocol
Source
Port
Destination
Address
Destination
Port
Deny all Deny Public Any Default1 Any Default
LPD Allow Public TCP Default Any 515
IPP Allow Public TCP Default Any 631