Article Sphere Logo
Computer And Technology Article

Cisco CBAC: - The Poor Mans Firewall

By Expert Author: Nicholas Evra
Word Count: 491 words | Views: 1744 view(s)
CBAC Overview

The Cisco IOS Firewall Feature Set is a module that can be added to the existing IOS to provide firewall functionality without the need for hardware upgrades. There are two components to the Cisco IOS Firewall Feature Set in Intrusion Detection (which is an optional bolt-on) and Context-Based Access Control (CBAC). CBAC maintains a state table for all of the outbound connections on a Cisco router by inspecting tcp and udp connections at layer seven of the OSI model and populating the table accordingly. When return traffic is received on the external interface it is compared against the state table to see if the connection was originally established from within the internal network, and then either permitted or denied. Although basic this is a very effective mechanism to prevent unauthorized access to the internal network from external sources such as the internet.

CBAC Application-specific support

Cisco have also built in some additional functionality into CBAC in terms of application-specific inspection that enables the router to recognize and identify application specific data flows such as HTTP, SMTP, TFTP, and FTP. Understanding these applications and their data flows empowers the router to identify malformed packets or suspect application data flows and permit or deny accordingly. CBAC also provides the flexibility of downloading Java code from trusted sites, but it denying untrusted sites.

CBAC and Denial of Service (DOS) Attacks

Denial-Of-Service (DOS) attack protection is also in-built with real-time logging of alerts as well as pro-active responses to mitigate the threat. To do this CBAC can be configured to manage half-open TCP connections which are used in TCP SYN flood attacks to overload a targets resources resulting in a denial of service to legitimate users. To do this CBAC uses timeouts and thresholds, which are configurable, to determine how long state information for each connection should be kept for sessions and when to drop them. Note that UDP and ICMP require that an idle-timer limit is used to determine when a connection should be terminated. A very useful command to identify a DOS attack is ‘ip inspect audit-trail’ which logs all DOS connections including source and destination IP address and TCP or UDP ports allowing you to pin-point the exact source and destination of the attack.

Configuring CBAC

There are five steps to configuring CBAC on a Cisco router in order for it to function correctly. These are as follows:

1. Choose an interface to which inspection will be applied. This can be an internal or external interface as CBAC is only concerned with the direction of the first packet initiating the connection which is identified when applying CBAC to an interface.

2. Configure an IP access list in the correct direction on the selected interface to allow traffic through for CBAC to inspect.

3. Configure global timeouts and thresholds for established connections or sessions.

4. Define an inspection rule specifying exactly which protocols will be inspected by CBAC.

5. Apply the inspection rule to the interface in the correct direction.
Nicholas Evra

About the Author:

Nicholas Evra is a Senior IT Consultant for a Professional Services IT Organisation based in London, UK. As well as designing and developing network and security solutions for clients, Nicholas also regularly contributes technical tips and articles on Networkblue.net. Networkblue.net is a technical resource for novices and expert’s alike providing free articles and tips on numerous cisco topics such as Cisco’s CBAC and other network security topics.

Article Source: http://www.articlesphere.com/Article/Cisco-CBAC----The-Poor-Mans-Firewall/148924

 This Article has been viewed 1744 times.
  

Related Videos



 

Related Articles

 
 

Listed below are more articles related to the above article from the "Computer And Technology" article category.

People interested in the above article "Cisco CBAC: - The Poor Mans Firewall" are also interested in the related articles listed below:

 
Research in wind power has now intensified because of its innate advantages over other power generators. With this increase in interest in wind energy and alternative energy sources as a whole, our future will become brighter and more and more remote areas will eventually enjoy the benefits of clean electric energy. In an electricity-dependent world, power supplies must provide the required electricity for communities and businesses. Wind powered generators might just be the solution for power shortages.
There are countless benefits of carefully selecting the right IT company for your business, however, many owners are unaware of them. Some business owners are aware but are unsure about where to begin. Small business owners wonder: 'My business is small, so do I really need IT?' The answer is YES. The smaller your business is, the more you need IT in order to gain a competitive advantage.
There are many support services available for those with pc and software problems. Not all of them are of the quality clients expect or deserve. But there are some factors that can turn a poor service into a quality service. This article details three of the factors clients should expect and IT support providers should provide, that will make excellent software and pc support services.
The history panel allows you to undo and redo steps on open flash documents. It contains additional features beyond the standard undo and redo commands. In this panel you can undo or redo chunks of steps as opposed to just one at a time. You can also create commands, clear, replay, and copy and paste steps all in this little panel. Access the history panel by selecting window | other panels | history from the menu or by pressing CTRL-F!) (Window)/OPTION-F10 (Mac). You can access the panel before, during, or after a season in flash.
Google Inc and Microsoft Corp will challenge the supremacy of Apple's iPad as new tablet models are announced in Taipe's Computex trade show this week. Google's Android OS and Microsoft's new Windows platform will be observed by investors and analyze if they are any match to Apple's iPad.
Different web technologies enable us to develop and create custom applications and add diverse functions to the web pages. With the assistance of web programming technology, we can create visual animation, reply to user actions, respond and interact with databases, and make available e-commerce solutions.
As a business owner, the need for a network support specialist is something that you shouldn't overlook. Put yourself in the shoes of a typical everyday computer problem situation.How are you going to employ your network support leads to find a network support team to settle your problems?
Article Directory Home All Categories Computer And Technology Cisco CBAC: - The Poor Mans Firewall
 

Can't find what you're looking for? Try Google Search!
 
Copyright © 2005 - by Larry Lim, Singapore - Article Search Engine Directory at ArticleSphere.com™
All Rights Reserved Worldwide. All Trademarks and Servicemarks are the property of the respective owners.