Cisco ASA 5506-X Configuration Guide

3-18
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 3 Access Control Lists
Edit ACLs in an Isolated Configuration Session
The options are:
• access_list_name—The name of the new or existing ACL. If the ACL already exists, you are adding
the ACE to the end of the ACL.
• Permit or Deny—The deny keyword denies a packet if the conditions are matched. The permit
keyword permits a packet if the conditions are matched.
• Traffic Matching Criteria—You can match traffic using the following options:
– ipx—Internet Packet Exchange (IPX).
– bpdu—bridge protocol data units, which are allowed by default.
– mpls-multicast— MPLS multicast.
– mpls-unicast—MPLS unicast.
– isis—Intermediate System to Intermediate System (IS-IS).
– any—Matches all traffic.
– hex_number—Any EtherType that can be identified by a 16-bit hexadecimal number 0x600 to
0xffff. See RFC 1700, “Assigned Numbers,” at http://www.ietf.org/rfc/rfc1700.txt for a list of
EtherTypes.
Examples for EtherType ACLs
The following examples shows how to configure EtherType ACLs, including how to apply them to an
interface.
The following sample ACL allows common traffic originating on the inside interface:
hostname(config)# access-list ETHER ethertype permit ipx
hostname(config)# access-list ETHER ethertype permit mpls-unicast
hostname(config)# access-group ETHER in interface inside
The following ACL allows some EtherTypes through the ASA, but it denies IPX:
hostname(config)# access-list ETHER ethertype deny ipx
hostname(config)# access-list ETHER ethertype permit 1234
hostname(config)# access-list ETHER ethertype permit mpls-unicast
hostname(config)# access-group ETHER in interface inside
hostname(config)# access-group ETHER in interface outside
The following ACL denies traffic with EtherType 0x1256, but it allows all others on both interfaces:
hostname(config)# access-list nonIP ethertype deny 1256
hostname(config)# access-list nonIP ethertype permit any
hostname(config)# access-group ETHER in interface inside
hostname(config)# access-group ETHER in interface outside
Edit ACLs in an Isolated Configuration Session
When you edit an ACL used for access rules or any other purpose, the change is immediately
implemented and impacts traffic. With access rules, you can enable the transactional commit model to
ensure that new rules become active only after rule compilation is complete, but the compilation happens
after each ACE you edit.

Cisco ASA 5506-X Specifications

General

Model	ASA 5506-X
Firewall Throughput	750 Mbps
Maximum Firewall Connections	50, 000
Maximum VPN Peers	50
Integrated Ports	8 x 1 GE
Stateful Inspection Throughput	750 Mbps
Weight	4.4 lb (2 kg)
Firewall Throughput (Multiprotocol)	750 Mbps
Firewall Throughput (Application Visibility and Control AVC)	250 Mbps
Concurrent Sessions	50, 000
New Connections per Second	10, 000
IPsec VPN Throughput	100 Mbps
Interfaces	8 x 1 GE
Memory	4 GB
Flash Memory	8 GB
Form Factor	Desktop
VPN Throughput	100 Mbps
Maximum Concurrent Sessions	50, 000
New Sessions per Second	10, 000
Operating Temperature	32 to 104°F (0 to 40°C)
Storage Temperature	-13 to 158°F (-25 to 70°C)
Power Supply	External
Humidity	10% to 90% non-condensing