44-2
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 44 Configuring the Cisco IOS Firewall Feature Set
Cisco IOS Firewall Guidelines and Restrictions
http://www.cisco.com/en/US/docs/ios/12_2/security/command/reference/fsecur_r.html
The following features are supported with and without the use of a Cisco IOS firewall image:
• Standard access lists and static extended access lists
• Lock-and-key (dynamic access lists)
• IP session filtering (reflexive access lists)
• TCP intercept
• Security server support
• Network address translation
• Neighbor router authentication
• Event logging
• User authentication and authorization
Note Cisco 7600 series routers support the Intrusion Detection System Module (IDSM) (WS-X6381-IDS).
Cisco 7600 series routers do not support the Cisco IOS firewall IDS feature, which is configured with
the ip audit command.
Cisco IOS Firewall Guidelines and Restrictions
When configuring the Cisco IOS firewall features, follow these guidelines and restrictions:
• On other platforms, if you enter the ip inspect command on a port, CBAC modifies ACLs on other
ports to permit the inspected traffic to flow through the network device. On Cisco 7600 series
routers, you must enter the mls ip inspect command to permit traffic through any ACLs that would
deny the traffic through other ports. Refer to the “Additional CBAC Configuration” section on
page 44-3 for more information.
• Reflexive ACLs and CBAC have conflicting flow mask requirements. Reflexive ACLs are processed
in software on the MSFC.
• CBAC is incompatible with VACLs. You can configure CBAC and VACLs on the router but not in
the same subnet (VLAN).
Note The Intrusion Detection System Module (IDSM) uses VACLs to select traffic. To use the
IDSM in a subnet where CBAC is configured, enter the mls ip ids acl_name interface
command, where acl_name is configured to select traffic for the IDSM.
• To inspect Microsoft NetMeeting (2.0 or greater) traffic, turn on both h323 and tcp inspection.
• To inspect web traffic, turn on tcp inspection. To avoid reduced performance, do not turn on http
inspection to block Java.
• QoS and CBAC do not interact or interfere with each other.
• You can configure CBAC on physical ports configured as Layer 3 interfaces and on VLAN
interfaces.
• You cannot configure VACLs and CBAC on the same interface.
To Next Page
Loading...
Need help?
General
