在标准 Cisco 3600 路由器中，我能够将 TCP 标志过滤应用于扩展访问列表：

R1#configure terminal
R1(config)#ip access-list extended 101
R1(config-ext-nacl)#

从这里，

R1(config-ext-nacl)#deny tcp any any ?
  ack          Match on the ACK bit
  dscp         Match packets with given dscp value
  eq           Match only packets on a given port number
  established  Match established connections
  fin          Match on the FIN bit
  fragments    Check non-initial fragments
  gt           Match only packets with a greater port number
  log          Log matches against this entry
  log-input    Log matches against this entry, including input interface
  lt           Match only packets with a lower port number
  neq          Match only packets not on a given port number
  precedence   Match packets with given precedence value
  psh          Match on the PSH bit
  range        Match only packets in the range of port numbers
  rst          Match on the RST bit
  syn          Match on the SYN bit
  time-range   Specify a time-range
  tos          Match packets with given TOS value
  urg          Match on the URG bit
  <cr>

但是，ASA 防火墙中似乎不存在这种按 TCP 标志过滤的功能。有没有我没有看到的菜单？如果是这种情况，为什么要禁止此功能？它不止一次派上用场。