Cisco Systems ASA 5585-X Manual De Usuario

 lists common traffic types that you can allow through the transparent firewall.

You can configure access rules that control management traffic destined to the ASA. Access control rules 
for to-the-box management traffic (defined by such commands as http, ssh, or telnet) have higher 
precedence than an management access rule applied with the control-plane option. Therefore, such 
permitted management traffic will be allowed to come in even if explicitly denied by the to-the-box ACL. 

This section describes EtherType rules and includes the following topics:

An EtherType rule controls the following:

EtherType identified by a 16-bit hexadecimal number, including common types IPX and MPLS 
unicast or multicast.

Ethernet V2 frames.

BPDUs, which are permitted by default. BPDUs are SNAP-encapsulated, and the ASA is designed 
to specifically handle BPDUs.

Trunk port (Cisco proprietary) BPDUs. Trunk BPDUs have VLAN information inside the payload, 
so the ASA modifies the payload with the outgoing VLAN if you allow BPDUs.

IS-IS.

The following types of traffic are not supported:

802.3-formatted frames—These frames are not handled by the rule because they use a length field 
as opposed to a type field.

DHCP

UDP ports 67 and 68

If you enable the DHCP server, then the ASA 
does not pass DHCP packets.

EIGRP

Protocol 88

—

OSPF

Protocol 89

—

Multicast streams The UDP ports vary depending 

on the application.

Multicast streams are always destined to a 
Class D address (224.0.0.0 to 239.x.x.x).

RIP (v1 or v2)

UDP port 520

—