{"id":644,"date":"2010-04-05T09:18:37","date_gmt":"2010-04-05T08:18:37","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=644"},"modified":"2010-04-11T09:30:17","modified_gmt":"2010-04-11T08:30:17","slug":"quick-practice-lab-configure-cbac","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=644","title":{"rendered":"Quick Practice Lab: Configure CBAC"},"content":{"rendered":"

This quick lab demonstrates how CBAC is configured and applied to interfaces.<\/p>\n

<\/p>\n

“Gateway” is configured with an ACL on the outside interface, preventing all traffic from entering\u00a0 the network. To allow internal machines to ping and telnet to the external network, “ip inspect” commands\u00a0 have been configured to permit established icmp, telnet, and tcp sessions.<\/p>\n

Testing CBAC:<\/strong><\/p>\n

    \n
  1. Ping 10.10.11.1 from External. The ping should fail since the ACL denies it.<\/li>\n
  2. Ping 10.20.1.1 from Internal. The ping should succeed because CBAC is configured.<\/li>\n
  3. Telnet to 10.20.1.1 from Internal. The telnet should succeed because CBAC is configured.<\/li>\n<\/ol>\n

    \"CBAC<\/a><\/p>\n

    Configuration on “Gateway”:<\/p>\n

    hostname Gateway
    \n!
    \nusername cisco password 0 cisco
    \n!
    \nip ssh version 1
    \n!
    \nip inspect audit-trail
    \nip inspect name testcbac telnet
    \nip inspect name testcbac tcp
    \nip inspect name testcbac icmp
    \n!
    \ninterface FastEthernet0\/0
    \nip address 10.10.11.2 255.255.255.0
    \nip inspect testcbac in
    \nduplex auto
    \nspeed auto
    \n!
    \ninterface FastEthernet0\/1
    \nip address 10.20.1.2 255.255.255.0
    \nip access-group cbac_acl in
    \nduplex auto
    \nspeed auto
    \n!
    \ninterface Vlan1
    \nno ip address
    \nshutdown
    \n!
    \nip classless
    \nip route 10.10.11.0 255.255.255.0 10.10.11.1
    \nip route 20.20.1.0 255.255.255.0 20.20.1.1
    \n!
    \nip access-list extended cbac_acl
    \ndeny ip any any
    \n!
    \nline con 0
    \nline vty 0 4
    \npassword cisco
    \nlogin
    \n!
    \nend<\/p><\/blockquote>\n

    Success Criteria:<\/p>\n

    Gateway#sh ip inspect all
    \nSession audit trail is enabled
    \nSession alert is enabled
    \none-minute (sampling period) thresholds are [unlimited : unlimited] connections
    \nmax-incomplete sessions thresholds are [unlimited : unlimited]
    \nmax-incomplete tcp connections per host is unlimited. Block-time 0 minute.
    \ntcp synwait-time is 30 sec — tcp finwait-time is 5 sec
    \ntcp idle-time is 3600 sec — udp idle-time is 30 sec
    \ntcp reassembly queue length 16; timeout 5 sec; memory-limit 1024 kilo bytes
    \ndns-timeout is 5 sec
    \nInspection Rule Configuration
    \nInspection name testcbac
    \ntelnet alert is on audit-trail is on timeout 3600
    \ntcp alert is on audit-trail is on timeout 3600
    \nicmp alert is on audit-trail is on timeout 10<\/p>\n

    Interface Configuration
    \nInterface FastEthernet0\/0
    \nInbound inspection rule is testcbac
    \ntelnet alert is on audit-trail is on timeout 3600
    \ntcp alert is on audit-trail is on timeout 3600
    \nicmp alert is on audit-trail is on timeout 10
    \nOutgoing inspection rule is not set
    \nInbound access list is not set
    \nOutgoing access list is not set<\/p>\n

    Gateway#<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

    This quick lab demonstrates how CBAC is configured and applied to interfaces.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[83,13],"tags":[24],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/644"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=644"}],"version-history":[{"count":11,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/644\/revisions"}],"predecessor-version":[{"id":676,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/644\/revisions\/676"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=644"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=644"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}