Difference between revisions of "Netband Project - IOS firewall"
From Teknologisk videncenter
(→Configuration) |
(→Configuration) |
||
| Line 10: | Line 10: | ||
[[Image:Netband-cbac.jpg|thumb|none|600px|CBAC]] | [[Image:Netband-cbac.jpg|thumb|none|600px|CBAC]] | ||
===Configuration=== | ===Configuration=== | ||
| − | <pre>ip inspect name iosfw | + | <pre> ip inspect name iosfw ftp |
| − | ip inspect name iosfw | + | ip inspect name iosfw tcp |
| + | ip inspect name iosfw udp | ||
| + | ip inspect name iosfw http | ||
| + | ip inspect name iosfw https | ||
| + | interface FastEthernet0/0 | ||
| + | ip inspect iosfw in | ||
</pre> | </pre> | ||
Revision as of 10:39, 27 April 2009
<accesscontrol>NetBand</accesscontrol> This page is part of the Netband Project
Contents
Context Based Access Control (CBAC)
- filters TCP and UDP packets based on application-layer protocol session information.
- more flexible than access control lists, that checks packets at the network layer, or at most, the transport layer
- inspects packet sequence numbers in TCP connections
- detects unusually high rates of new connections and issue alert messages.
- creates temporary openings in the return acl to allow traffic back in.
Configuration
ip inspect name iosfw ftp ip inspect name iosfw tcp ip inspect name iosfw udp ip inspect name iosfw http ip inspect name iosfw https interface FastEthernet0/0 ip inspect iosfw in