O'Reilly logo

CCIE Security Practice Labs by Fahim Hussain Yusuf Bhaiji

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Section 6.0: IOS Firewall Configuration

6.1. Context-Based Access Control (CBAC)

  1. Configure CBAC on R5 for traffic going to the Internet. Apply outbound inspection on Ethernet0.

  2. Configure ingress ACL 101 on Internet link Ethernet0 to protect from RFC1918. See Example 3-26.

  3. Modify CBAC thresholds for TCP and UDP idle-time to 30 minutes and 15 seconds respectively. See Example 3-26.

  4. Tune the firewall to start deleting half-open sessions at 1000 and stop when the connection drops to 800 sessions. See Example 3-26.

Example 3-26. CBAC Configuration on R5
						!Snip from R5 ip inspect max-incomplete high 1000 ip inspect max-incomplete low 800 ip inspect one-minute high 1000 ip inspect one-minute low 800 ip inspect udp idle-time 15 ip inspect tcp idle-time ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required