21-2
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter21 Using the ACL Manager
Adding ACLs and ACEs
Guidelines and Limitations This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
Supported in single and multiple context mode.
Firewall Mode Guidelines
Supported in routed and transparent firewall modes only.
IPv6 Guidelines
IPv6 is supported.
Additional Guidelines and Limitations
The following guidelines and limitations apply to creating an extended access list:
•Enter the access list name in uppercase letters so that the name is easy to see in the configuration.
You might want to name the access list for the interface (for example, INSIDE), or you can name it
for the purpose for which it is created (for example, NO_NAT or VPN).
•You can specify the source and destination ports only for the TCP or UDP protocols. For a list of
permitted keywords and well-known port assignments, see the “TCP and UDP Ports” section on
page A-11. DNS, Discard, Echo, Ident, NTP, RPC, SUNRPC, and Talk each require one definition
for TCP and one for UDP. TACACS+ requires one definition for port 49 on TCP.
Adding ACLs and ACEs
An access list (ACL) is made up of one or more access list entries (ACEs). To create an ACL, you start
by creating an ACE and applying a list name. An ACL with one entry is still considered a list, although
you can add multiple ACEs to the list.
To add an ACL and then add an ACE to that ACL, perform the following steps:
Step1 Choose Configuration > Firewall > Advanced > ACL Manager.
Step2 Click Add, and choose one of the following options:
•Add ACL—Adds an ACL for IPv4 traffic
•Add IPv6 ACL—Adds an ACL for IPv6 traffic
Step3 In the ACL name field, add a descriptive name for the ACL, and click OK.
Your newly created ACL appears in the window.
Step4 Select the newly created ACL, click Add, and from the drop-down list, choose Add ACE.
Step5 In the Action field of the Add ACE window, click one of the following radio buttons to choose the action
•Permit—Permits access if the conditions are matched.
•Deny—Denies access if the conditions are matched.
Model License Requirement
All models Base License.