Lab 6.2 Configuring CBAC

attempted, the denied packets from OUTSIDE to INSIDE would be logged to
FW’s console line as well.
INSIDE# ping 192.168.23.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.23.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/56/60 ms
FW#
*Feb 18 02:23:29.591: CBAC: ICMP Echo pkt 172.16.12.1 => 192.168.23.3
*Feb 18 02:23:29.591: CBAC: ICMP Echo pkt 172.16.12.1 => 192.168.23.3
*Feb 18 02:23:29.591: CBAC: ICMP Echo pkt 172.16.12.1 => 192.168.23.3
*Feb 18 02:23:29.619: CBAC: ICMP Echo Reply pkt 192.168.23.3 => 172.16.12.1
*Feb 18 02:23:29.647: CBAC: ICMP Echo pkt 172.16.12.1 => 192.168.23.3
*Feb 18 02:23:29.675: CBAC: ICMP Echo Reply pkt 192.168.23.3 => 172.16.12.1
*Feb 18 02:23:29.703: CBAC: ICMP Echo pkt 172.16.12.1 => 192.168.23.3
*Feb 18 02:23:29.735: CBAC: ICMP Echo Reply pkt 192.168.23.3 => 172.16.12.1
*Feb 18 02:23:29.763: CBAC: ICMP Echo pkt 172.16.12.1 => 192.168.23.3
*Feb 18 02:23:29.791: CBAC: ICMP Echo Reply pkt 192.168.23.3 => 172.16.12.1
*Feb 18 02:23:29.819: CBAC: ICMP Echo pkt 172.16.12.1 => 192.168.23.3
*Feb 18 02:23:29.847: CBAC: ICMP Echo Reply pkt 192.168.23.3 => 172.16.12.1
FW# undebug all
Final Configurations
INSIDE# show run
hostname INSIDE
!
interface Serial0/0/0
ip address 172.16.12.1 255.255.255.0
clock rate 64000
no shutdown
!
ip route 0.0.0.0 0.0.0.0 172.16.12.2
!
line vty 0 4
password cisco
login
end
FW# show run
hostname FW
!
ip inspect name myrules tcp
ip inspect name myrules udp
ip inspect name myrules icmp timeout 5
ip inspect name myrules http alert off
ip inspect name myrules ftp audit-trail on
ip inspect udp idle-time 60
!
interface Serial0/0/0
ip address 172.16.12.2 255.255.255.0
ip inspect myrules in
no shutdown
!
interface Serial0/0/1
ip address 192.168.23.2 255.255.255.0
ip access-group 100 in
clock rate 64000
no shutdown
7 - 8 CCNP: Implementing Secure Converged Wide-area Networks v5.0 - Lab 6-2 Copyright © 2007, Cisco Systems, Inc