In a standard Cisco 3600 router, I am able to apply TCP flag filtering to an extended access list:

R1#configure terminal
R1(config)#ip access-list extended 101

From here,

R1(config-ext-nacl)#deny tcp any any ?
  ack          Match on the ACK bit
  dscp         Match packets with given dscp value
  eq           Match only packets on a given port number
  established  Match established connections
  fin          Match on the FIN bit
  fragments    Check non-initial fragments
  gt           Match only packets with a greater port number
  log          Log matches against this entry
  log-input    Log matches against this entry, including input interface
  lt           Match only packets with a lower port number
  neq          Match only packets not on a given port number
  precedence   Match packets with given precedence value
  psh          Match on the PSH bit
  range        Match only packets in the range of port numbers
  rst          Match on the RST bit
  syn          Match on the SYN bit
  time-range   Specify a time-range
  tos          Match packets with given TOS value
  urg          Match on the URG bit

However, this functionality to filter by TCP flag seems non existent in ASA firewalls. Is there a menu I am not seeing? If this is the case, why disallow this feature? It has come in handy more than once.

  • Which flags are you trying to filter for? The ASA might already be filtering them. Or, there might be another way of doing it.
    – Eddie
    Jan 20, 2015 at 3:26

1 Answer 1


The ASA doesn't have the same filtering capabilities, unfortunately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.