User's Manual

Firewall
Configuring the Firewall Access Rules to Control Inbound and Outbound Traffic
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 180
6
NOTE The firewall access rules only support for inter-zones.
Priorities of Firewall Access Rules
The security appliance includes three types of firewall access rules:
• Default access rules: The firewall access rules that are predefined on your
security appliance for all predefined zones and new zones. The default
access rules cannot be deleted and edited.
• Custom access rules: The firewall access rules that are customized by
users. The security appliance supports up to 100 custom access rules.
• VPN access rules: The firewall access rules that are automatically
generated by the VPN access control settings. The VPN access rules
cannot be edited in the Firewall -> ACL Rules -> Rule page. To edit the
VPN access control settings, go to the VPN pages. For more information
about the VPN access control settings, see VPN, page 232.
All firewall access rules are displayed in the Rule table and sorted by the priority.
The custom access rules have the highest priority. The VPN access rules have
higher priorities than the default access rules, but lower than the custom access
rules.
Preliminary Tasks for Configuring the Firewall Access Rules
Depending on the firewall settings that you want to use, you might need to
complete the following tasks before you configure the firewall access rules:
• To create the firewall access rule that applies only to a specific zone except
the predefined zones, first create the zone. See Configuring the Zones,
page 127.
• To create the firewall access rule that applies to a specific service or
service group, first create the service or service group object. See Service
Management, page 154.
• To create the firewall access rule that applies only to a specific address or
group address, first create the address or group address object. See
Address Management, page 152.