Download pdf - Free Books

Section 13 IPexpert’s CCIE Security Proctor Guide – Version 4.1
8 - IOS Firewall Configuration (8 Points)
8.1 - Cisco IOS Firewall (4 Points)
a) On R4, inspect all tcp, udp and icmp traffic from the Ethernet segment going towards the Frame
networks.
Start by configuring the inspection, and apply to the interface.
R4(config)#ip inspect name MYFW tcp
R4(config)#ip inspect name MYFW udp
R4(config)#ip inspect name MYFW icmp
R4(config)#int ser0/0/0
R4(config-if)#ip inspect MYFW out
b) Only allow relevant traffic coming in.
We have BGP and OSPF sessions to permit.
R4(config)#ip access-list extended 121
R4(config-ext-nacl)#permit tcp host 2.2.2.2 host 4.4.4.4 eq bgp
R4(config-ext-nacl)#permit tcp host 2.2.2.2 eq bgp host 4.4.4.4 est
R4(config-ext-nacl)#permit ospf host 192.1.24.2 host 224.0.0.5
R4(config-ext-nacl)#permit ospf host 192.1.24.2 host 192.1.24.4
R4(config-ext-nacl)#deny ip any any log
c) ACL should be set to inbound on the Serial interface.
R4(config)#int ser0/0/0
R4(config-if)#ip access-group 121 in
8.2 - Cisco IOS Firewall tuning (2 Points)
a) Set the IOS Firewall such that it blocks half-open connections if they exceed 1000 and stop
deleting the connections if the reach 800.
b) Also set it for a one-minute high.
c) Set the TCP idle time to 30 Minutes.
R4(config)#ip inspect max-incomplete high 1000
R4(config)#ip inspect max-incomplete low 801
R4(config)#ip inspect one-minute high 1000
R4(config)#ip inspect one-minute low 801
R4(config)#ip inspect tcp idle-time 1800
362 Copyright IPexpert, Inc. (http://www.ipexpert.com) 2007. All Rights Reserved.