{"id":661,"date":"2010-04-10T18:17:40","date_gmt":"2010-04-10T17:17:40","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=661"},"modified":"2010-04-15T20:36:30","modified_gmt":"2010-04-15T19:36:30","slug":"configuring-cbac-on-cisco-1841","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=661","title":{"rendered":"Configuring CBAC on Cisco 1841"},"content":{"rendered":"<p>Context-Based Access Control (CBAC) intelligently filters TCP and UDP packets based on application layer protocol session information and can be used for intranets, extranets and internets.\u00a0 CBAC can be configured to permit specified TCP and UDP traffic through a firewall only when the connection is initiated from within the network needing protection.<\/p>\n<p>CBAC can inspect traffic for sessions that originate from either side of the firewall. This is the basic function of a stateful inspection firewall.<!--more--><\/p>\n<p>CBAC allows network  administrators to implement firewall intelligence as part of an  integrated, single-box solution.<\/p>\n<p>For example, sessions with an extranet  partner involving Internet applications, multimedia applications, or  Oracle databases would no longer necessitate opening a network doorway  accessible via weaknesses in the partner`s network.<\/p>\n<p>CBAC lets  tightly-secured networks run today`s basic application traffic plus  advanced applications such as multimedia and video conferencing securely  through a router.<\/p>\n<p>CBAC is a per-application control mechanism for IP traffic including  standard TCP and UDP Internet applications, multimedia applications  (including H.323 and other video applications), and Oracle databases.<\/p>\n<ul>\n<li>Before CBAC, administrators could permit advanced application traffic  only by writing permanent ACLs that essentially left firewall doors  open, so most administrators opted to deny all such application traffic.<\/li>\n<li>Now with CBAC, they can securely permit multimedia and other  application traffic by opening the firewall as needed, and closing it  all other times.<\/li>\n<\/ul>\n<p>For example, if CBAC is configured to allow Microsoft  NetMeeting, when an internal user initiates a connection, the firewall  permits return traffic. However, if an external NetMeeting source  initiates a connection with an internal user, CBAC denies entry and  drops the packets.<\/p>\n<p><strong>Configuration<\/strong>:<\/p>\n<p>A basic template for an internet-facing Cisco 1841 with an inside LAN of 192.168.150.0\/24\u00a0 (For an advanced template for an internet router, <a href=\"http:\/\/darenmatthews.com\/blog\/?p=653\">see here<\/a>).<\/p>\n<p>For CBAC configuration testing, I have a <a href=\"http:\/\/darenmatthews.com\/blog\/?p=644\">Quick Practice Lab<\/a>)<\/p>\n<blockquote><p>!<br \/>\nusername [a user] password [a password]<br \/>\n!<br \/>\naaa new-model<br \/>\naaa authentication login default local<br \/>\nip inspect name my_firewall ftp timeout 3600<br \/>\nip inspect name my_firewall smtp timeout 3600<br \/>\nip inspect name my_firewall udp timeout 15<br \/>\nip inspect name my_firewall tcp timeout 3600<br \/>\n!<br \/>\ninterface FastEthernet0\/0<br \/>\ndescription Inside of Network<br \/>\nip address 192.168.150.1 255.255.255.0<br \/>\n!<br \/>\ninterface FastEthernet0\/1<br \/>\ndescription Outside of network<br \/>\nip address &lt;outside IP&gt; &lt;subnet mask&gt;<br \/>\nip access-group OUTSIDE_IN in<br \/>\nip inspect name my_firewall out<br \/>\n!<br \/>\nip nat inside source list NAT interface FastEthernet0\/1 overload<br \/>\n!<br \/>\nip classless<br \/>\n!<br \/>\nip route 0.0.0.0 0.0.0.0 &lt;default gateway&gt;<br \/>\n!<br \/>\nno ip http server<br \/>\nno ip http secure-server<br \/>\n!<br \/>\nline con 0<br \/>\nlogging sync<br \/>\nline vty 0 15<br \/>\ntrans input ssh<br \/>\nlogging sync<br \/>\n!<br \/>\nip access-list extended NAT<br \/>\npermit ip 192.168.150.0 0.0.0.255 any<br \/>\n!<br \/>\nip access-list extended OUTSIDE_IN<br \/>\ndeny\u00a0\u00a0 ip host 0.0.0.0 any<br \/>\ndeny\u00a0\u00a0 ip 127.0.0.0 0.255.255.255 any<br \/>\ndeny\u00a0\u00a0 ip 192.0.2.0 0.0.0.255 any<br \/>\ndeny\u00a0\u00a0 ip 224.0.0.0 31.255.255.255 any<br \/>\ndeny\u00a0\u00a0 ip 10.0.0.0 0.255.255.255 any<br \/>\ndeny\u00a0\u00a0 ip 172.16.0.0 0.15.255.255 any<br \/>\ndeny\u00a0\u00a0 ip 192.168.0.0 0.0.255.255 any<br \/>\npermit icmp any any echo-reply<br \/>\npermit icmp any any time-exceeded<br \/>\ndeny\u00a0\u00a0 ip any any<br \/>\n!<br \/>\ncrypto key gen rsa general-keys mod 1024<\/p><\/blockquote>\n<p><strong>To see how CBAC works<\/strong> refer to this <a href=\"http:\/\/darenmatthews.com\/blog\/?p=644\">Quick Practice Lab<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Context-Based Access Control (CBAC) intelligently filters TCP and UDP packets based on application layer protocol session information and can be used for intranets, extranets and internets.\u00a0 CBAC can be configured to permit specified TCP and UDP traffic through a firewall only when the connection is initiated from within the network needing protection. CBAC can inspect [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[83,13],"tags":[24],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/661"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=661"}],"version-history":[{"count":15,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/661\/revisions"}],"predecessor-version":[{"id":663,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/661\/revisions\/663"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=661"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}