ASA and ISIS

[ahmede1]

We are running CLNS ISIS, between two routers, we are inserting ASA in between to act as L2 FW.

I know starting version 9.5, ASA supports ISIS.

We had to add "ethertype permit any" rule at the end of the ACL to make ISIS works. But we are trying to limit the Ethertype by specifying the Ethertype #.  Anyone knows what is the Ethertype# used by ISIS? Is there any other way to allow ISIS packets through the L2 FW? 

[Flavio Miranda]

Hi @ahmede1

According to this doc, there´s an ACL specific for ISIS:

access-list access_list_name ethertype
{deny | permit} {ipx | bpdu | mpls-unicast
| mpls-multicast | is-is | any |
hex_number}

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/acl-ethertype.pdf

-If I helped you somehow, please, rate it as useful.-

[ahmede1]

Thank you.. We did try that, but it doesn't work.. Once we add ISIS only, ISIS stops working, we also see no hits on the access list

access-list ISIS_ACL ethertype permit isis (hitcount=0)

access-list ISIS_ACL ethertype permit any (hitcount=275201669)

[Flavio Miranda]

That's weird. Should work and we can't suppose that some necessary  traffic is being blocked, wouldn't make sense as the documentation is clear to use isis as ethertype and nothing more.