User's Manual

Firewall
Configuring the Firewall Access Rules to Control Inbound and Outbound Traffic
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 178
6
Configuring the Firewall Access Rules to Control Inbound and
Outbound Traffic
The zone-based firewall access rules can permit or deny inbound or outbound
traffic based on the zone, service, source and destination address. It includes the
following sections:
• Default Firewall Settings, page 178
• Priorities of Firewall Access Rules, page 180
• Preliminary Tasks for Configuring the Firewall Access Rules, page 180
• General Settings for Configuring the Firewall Access Rules, page 181
• Configuring a Firewall Access Rule, page 183
• Configuring a Firewall Access Rule to Allow the Multicast Traffic,
page 185
NOTE For detailed firewall configuration examples, see Firewall Access Rule
Configuration Examples, page 187.
Default Firewall Settings
By default, your firewall prevents all traffic from a lower security level to a higher
security level (commonly known as Inbound) and allows all traffic from a higher
security level to a lower security level (commonly known as Outbound). If you want
to allow some inbound access or prevent some outbound access, you must
configure the firewall access rules.
The following table lists the default access control settings for the traffic between
different security levels. For more information about the security level definition for
zones, see Security Levels for Zones, page 128.
From\To
Trusted(100) VPN(75) Public(50) GUEST(25) Untrust(0)
Trusted(100) Deny Permit Permit Permit Permit
VPN(75) Deny Deny Permit Permit Permit