IOS Firewall IOS Ciscos Internetwork Operating System the

IOS Firewall • IOS: Cisco’s Internetwork Operating System (the primary system running on Cisco’s routers) • IOS Firewall: a stateful packet-filter firewall that runs on a router, providing firewall capabilities • CBAC: Context-Based Access Control (at the core of the IOS Firewall functionality http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt

Outline • CBAC • IOS Firewall Features • Case studies http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt 2

CBAC (Context-Based Access Control) • Implement packet filtering on a Cisco router (similar to ASA on Cisco PIX) • Three basic functionalities: 1. Dynamic modification of the extended access lists 1. 2. 3. To allow connections initiated from the inside Inspection of the application/transport level protocols ~= multimedia support in PIX Control of the number/length of sessions http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt 3

CBAC Functionality 1. Set up Access Control Lists to open holes for inbound access to inside servers 2. Set up the router to inspect outbound packets, and 3. Keep track of the associated sessions i. e. , a stateful packet filter http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt 4

How does IOS maintain session state information? • State Information Structure (SIS) – – A SIS is created for each logical session. The SIS uniquely identifies a connection using the IP and the port#). When necessary, other info such as TCP connection state, TCP sequence number, etc. are also maintained. The SIS is deleted when the associated session/connection is terminated. http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt 5

Other CBAC functionality 1. 2. 3. 4. 5. 6. 7. Out-of-sequence TCP packets are dropped. TCP packets with invalid sequence numbers are dropped. The reassembly of IP packets is not supported (as in PIX firewall). Does not inspect packets originated by the IOS Firewall router. ICMP packets are not inspected. (They are manually managed using static ACLs). ICMP unreachable packets are ignored. To protect against a flooding attack or unusual consumption of memory due to a large number of SISs: 1. 2. when the number of SISs in the half-open state reaches a threshold, half-open SISs are deleted to accommodate a new session. If the rate of new TCP connection requests is higher than a maximum value, half-open SISs are deleted for every new connection request. http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt 6

Features of IOS Firewall • • • Transport Layer Inspection Application Layer Inspection Filtering for Invalid Commands Java Blocking Safeguarding against DOS attacks Fragment handling http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt 7

Case Study • CBAC on a router configured with NAT http: //sce. uhcl. edu/yang/teaching/. . . /IOS Firewalls. ppt 8