Lab 6.2 Configuring CBAC

Why is this particularly important for UDP protocols
On a per-protocol basis, there are other adjustable settings. For instance, you
can manipulate CBAC to trigger logging messages based on the matched
protocol. This is important for security accounting as well as for debugging
purposes. View the options available on a per-protocol basis, using the
character.
FW(config)# ip inspect name myrules tcp
alert
Turn on/off alert
audit-trail Turn on/off audit trail
router-traffic Enable inspection of sessions to/from the router
timeout
Specify the inactivity timeout time
In a secure network, you would likely set up a Syslog server to monitor security
information including communication to external networks. Alert and audit trail
messages allow holes in the firewall created by CBAC to be monitored and
logged for later use. By default, CBAC logs alert messages to the console
which can be configured on a per-protocol basis to override the global settings
for the alert messages (as shown above). To change the global setting for
alerts, use the command ip inspect alert-off. By default, alerts are on. To
enable audit-trail messages, use the global command ip inspect audit-trail. By
default, audit-trail messages are off. The timeout argument specifies a perprotocol
connection timeout period. Add in Internet Control Message Protocol
(ICMP) with a timeout time of 5 seconds, HTTP inspection without alerting, and
FTP inspection with an audit-trail. ICMP inspection may not work on older IOS
releases.
FW(config)# ip inspect name myrules icmp timeout 5
FW(config)# ip inspect name myrules http alert off
FW(config)# ip inspect name myrules ftp audit-trail on
To apply the rule set to an interface, use the interface level command ip
inspect name direction. Apply “myrules” to the inside interface on FW with an
inbound direction. This means that any traffic initiated from the inside interface
going through the router will have IP inspection performed on it.
FW(config)# interface serial0/0/0
FW(config-if)# ip inspect myrules in
In this scenario, you could also apply it outbound on the outside interface to
achieve the same effect. When would this not apply
4 - 8 CCNP: Implementing Secure Converged Wide-area Networks v5.0 - Lab 6-2 Copyright © 2007, Cisco Systems, Inc