User's Manual

Firewall
Configuring the Firewall Access Rules to Control Inbound and Outbound Traffic
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 185
6
Configuring a Firewall Access Rule to Allow the Multicast
Traffic
By default, the multicast traffic from any zone to any zone is blocked by the default
firewall access rules. To enable the multicast, you first need to uncheck the Block
Multicast Packets box in the Firewall -> Attack Protection page and then
manually create the firewall rules to allow multicast forwarding from a specific
zone to other zones. The security appliance predefines a multicast address for this
purpose.
For example, IGMP Proxy can be active from WAN to LAN. When you enable IGMP
Proxy and want to receive the multicast packets from WAN to LAN, you need to
uncheck the Block Multicast Packets box in the Firewall -> Attack Protection
page, and create a firewall access rule to permit the multicast traffic from WAN to
LAN.
This section provides a configuration example about how to create a WAN-to-LAN
access rule to permit the multicast traffic by using the predefined multicast
address.
STEP 1 Click Firewall -> ACL Rules -> Rule.
The ACL Rules window opens.
STEP 2 To add a new access rule, click Add.
After you click Add, the Rule - Add/Edit window opens.
STEP 3 Enter the following information:
• Enable: Click On to enable the fireall access rule.
• From Zone: Choose WAN as the source zone of the traffic.
• To Zone: Choose LAN as the destination zone of the traffic.
• Services: Choose ANY for this rule.
• Source Address: Choose ANY as the source address for this rule.
• Destination Address: Choose the existing address called “Multicast” as the
destination address for this rule. The Multicast address object is predefined
on your security appliance for creating multicast firewall access rules.
• Schedule: Choose Always On for this rule.
• Log: Click Off for this rule. We recommend that you disable the Log feature
for a multicast firewall access rule.