Cisco Firewalls

Chapter 11. Additional Protection Mechanisms

This chapter covers the following topics:

• Antispoofing

• TCP Flags Filtering on IOS

• Filtering on the TTL value on IOS

• Handling IP Options

• Dealing with IP Fragmentation

• Flexible Packet Matching

• Time-based ACLs

• Connection Limits on ASA

• TCP Normalization on ASA

• Threat Detection on ASA

“There are more things in heaven and earth, Horatio, Than are dreamt of in your philosophy.” —William Shakespeare, Hamlet

Having thoroughly studied stateful inspection, it is now time to devote some attention to a set of additional protection mechanisms that operate on Layers 3 and 4 and might prove useful to many network environments. Although most of them are stateless features, they have the potential ...