How Classic Firewall Works
I licvvail U3C9 MVjl_ uyjjc router(config) ip access-list 104 deny ip any any router(config) ip access-list 103 permit http any any router(conf ig) ip inspect name FWRULE tcp router(config) interface S0 router(config-if) ip access-group 103 out router(config-if) ip access-group 104 in router(config-if) ip inspect FWRULE out router show ip inspect sessions Established Sessions Session 641721A8 (10.0.1.12 3575) > (10.0.6.12 80) http SIS_OPEN 2007 Cisco Systems, Inc. All rights reserved....
Layer 7 classmap type inspect Command
Examines SMTP traffic for large packets R1(config) R1(config-R1(config-R1(config) R1(config-R1(config-R1(config) R1(config-R1(config-R1(config- class-map type inspect smtp huge-mails cmap) match data-length gt 100000 --- policy-map type inspect pmap) class type inspect pmap-c) reset pmap-c) exit pmap) exit class-map type inspect c cmap) match protocol smtp cmap) exit policy-map type inspect mypolicy pmap) class type inspect c1 pmap-c) inspect pmap-c) service-policy smtp mysmtp-policy 2007 Cisco...
Alerts and Audit Trails
Cisco IOS classic firewall also generates real-time alerts and audit trails. Enhanced audit trail features use syslog to track all network transactions recording time stamps, source host, destination host, ports used, and the total number of transmitted bytes, for advanced, session-based reporting. Real-time alerts send syslog error messages to central management consoles upon detecting suspicious activity. Using Cisco IOS classic firewall inspection rules, you can configure alerts and audit...
SPI or CBAC
Cisco IOS SPI can be described as a mechanism to discover good connections that originate on the secure (trusted) side of the firewall, and watch for and allow the return traffic that correlates with these connections. Connections originating on the unsecure (untrusted) side of the firewall are not allowed to reach the secure network, as controlled by an ACL facing the unsecure network as shown in the figure above. Many changes have been made to CBAC to enhance its capability and increase...
Port to Application Mapping
Router(config) ip port-map http port 8080 Maps a port number to an application router(config) access-list 110 permit 10.0.1.12 router(config) ip port-map http port 8080 list 110 Maps a port number to an application for a given host - Host 10.0.1.12 uses port 8080 for http services router(config) access-list 110 permit 10.0.1.0 0.0.0.255 router(config) ip port-map http port 8080 list 110 Maps a port number to an application for a given network 2007 Cisco Systems, Inc. All rights reserved. SNRS...
Enable Audit Trails and Alerts
Router(config) service timestamps log datetime router(config) logging 10.0.0.3 router(config) logging facility syslog router(config) logging trap 7 router(config) ip inspect audit-trail Turn on logging and audit trail to provide a record of network access through the firewall, including illegitimate access attempts, and inbound and outbound services. Follow this procedure to configure logging and audit trail functions Step 1 Add the date and time to syslog and audit trail messages....
Half Opened Connection Limits by Host
Ip inspect tcp max-incomplete host number block-time minutes This command defines the number of half-opened TCP sessions with the same host destination address that can exist at a time before the Cisco IOS classic firewall starts deleting half-open sessions to the host. After the number of half-opened connections to a given host is exceeded, the software deletes half-opened sessions on that host in the following manner - If the block time is 0, the oldest half-opened session is deleted, per new...
Half Open Sessions
An unusually high number of half-opened sessions (either absolute or measured as the arrival rate) could indicate that a DoS attack is occurring. For TCP, half-opened means that the session has not reached the established state the TCP three-way handshake has not yet been completed. For UDP, half-opened means that the firewall has detected no return traffic. Cisco IOS classic firewall measures both the total number of existing half-opened sessions and the rate of session establishment attempts....
Zoning Rules Summary
If two interfaces are not in zones, traffic flows freely between them. If one interface is in a zone, and another interface is not in a zone, traffic may never flow between them. If two interfaces are in two different zones, traffic will not flow between the interfaces until a policy is defined to allow the traffic. 2007 Cisco Systems, Inc. All rights reserved SNRS V2.0 5-8 Zoning rules may be summarized as follows Traffic flows freely between interfaces that are not in a zone. If one...
Application Firewall Policy for HTTP
Router(config) appfw policy-name HTTP-Policy router(cfg-appfw-policy) application http router(cfg-appfw-policy-http) strict-http action allow alarm router(cfg-appfw-policy-http) content-length maximum 1 action allow alarm router(cfg-appfw-policy-http) content-type-verification match-req-rsp action allow alarm router(cfg-appfw-policy-http) max-header-length request 1 response 1 action allow alarm router(cfg-appfw-policy-http) max-uri-length 1 action allow alarm router(cfg-appfw-policy-http)...
Application Firewall Policy for Instant Messaging IM
Router(config) appfw policy-name IM-Policy router(cfg-appfw-policy) application im yahoo router(cfg-appfw-policy-ymsgr) server permit name scs.msg.yahoo.com router(cfg-appfw-policy-ymsgr) server permit name scsa.msg.yahoo.com router(cfg-appfw-policy-ymsgr) server permit name scsb.msg.yahoo.com router(cfg-appfw-policy-ymsgr) server permit name scsc.msg.yahoo.com router(cfg-appfw-policy-ymsgr) service text-chat action allow router(cfg-appfw-policy-ymsgr) service default action reset...
Signature Definition File SDF
A SDF contains all or a subset of the signatures supported by Cisco IPS. An IPS loads the signatures contained in the SDF and scans incoming traffic for matching signatures. The IPS enforces the policy defined in the signature action. Cisco IPS uses the SDF to populates internal tables with the information necessary to detect each signature. The SDF can be saved on the router flash memory. SDFs are downloaded from cisco.com. 2007 Cisco Systems, Inc. All rights reserved. SNRS v2.0-5-E The SDF...
Signature Micro Engines
An SME is a component of IOS IPS that supports signatures in a certain category. Each engine is customized for the protocol and fields it is designed to inspect, and defines a set of legal parameters that have allowable ranges or sets of values. The SMEs look for malicious activity in a specific protocol. All the signatures in a given micro-engine are scanned in parallel fashion rather than serially. 15 SMEs in 12.4(4) T or later OTHER engine has hard-coded signatures 2007 Cisco Systems, Inc....
Configuring a Cisco IOS Zone Based Policy Firewall
Identify interfaces that share the same function security and group them into the same security zones. 2. Determine the required traffic flow between zones in both directions. 4. Set up zone pairs for any policy other than deny all. 5. Define class maps to describe traffic between zones. 6. Associate class maps with policy maps to define actions applied to specific policies. There are several steps required to configure a Cisco IOS zone-based policy firewall. The following procedure can be used...
