7-5
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter7 Configuring Access Rules
Information About Access Rules

Guidelines and Limitations

Context Mode Guidelines
Supported in single and multiple context mode.
Firewall Mode Guidelines
Supported in routed and transparent firewall mode.
IPv6 Guidelines
Supports IPv6.
Additional Guidelines and Limitations
Evaluate the following alternatives before using the transactional commit model:
•While using large rules, try to optimize the number of rules by using the Object Group Search setting
in Advanced Access Rule Configuration settings. For more information see, Advanced Access Rule
Configuration, page7-11.
•Perform an incremental rule update instead of a bulk rule update. If a bulk update is necessary
perform the bulk update during the maintenance window, when traffic is low.
Information About Access Rules
This section describes information about access rules and includes the following topics:
•Access Rules for Returning Traffic, page7-5
•Allowing Broadcast and Multicast Traffic through the Transparent Firewall Using Access Rules,
page 7-5
•Management Access Rules, page 7-6

Access Rules for Returning Traffic

For TCP and UDP connections for both routed and transparent mode, you do not need an access rule to
allow returning traffic because the ASA allows all returning traffic for established, bidirectional
connections.
For connectionless protocols such as ICMP, however, the ASA establishes unidirectional sessions, so
you either need access rules to allow ICMP in both directions (by applying ACLs to the source and
destination interfaces), or you need to enable the ICMP inspection engine. The ICMP inspection engine
treats ICMP sessions as bidirectional connections.

Allowing Broadcast and Multicast Traffic through the Transparent Firewall Using Access Rules

In routed firewall mode, broadcast and multicast traffic is blocked even if you allow it in an access rule,
including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay).
Transparent firewall mode can allow any IP traffic through.
Note Because these special types of traffic are connectionless, you need to apply an access rule to both
interfaces, so returning traffic is allowed through.