All Cisco-Network Study Notes

Application Analysis and Ascendancy (AIC)

In accession to the all-encompassing ZFW appearance and capabilities, ZFW extends the action of appliance inspection

and ascendancy (AIC) agent by accouterment added capabilities to the ZFW. AIC behavior are activated at Layer 7 of

the OSI model, assuming abysmal packet analysis at the application-protocol level.

ZFW offers appliance analysis and ascendancy for the afterward appliance services:

HTTP

SMTP

POP3

IMAP

Sun alien action call

Peer-to-peer appliance traffic

Instant Messaging applications

Note

AIC is configured as an added set of application-specific class-maps and policy-maps, which are then

applied to absolute analysis class-maps and policy-maps.

Summary

This affiliate discussed the router-based IOS Firewall technology and focused mainly on one of the several

subsystems—the SPI technology that uses the classical firewall that in about-face uses CBAC and the new ZFW

structures. SPI is an avant-garde firewall agent for stateful analysis accouterment traffic-filtering functionality on a

Cisco IOS–based accessory as a distinct point of protection.

The affiliate declared CBAC functions and how they assignment application step-by-step agreement processes with

examples.

The affiliate additionally covered the new ZFW abstraction application aegis zones and exemplified the appropriate accomplish to

configure the ZFW.

The affiliate additionally provided an overview of some of the avant-garde IOS Firewall appearance alien in the newer

IOS Software versions.

References

www.cisco.com/en/US/products/ps6441/products_configuration_guide_book09186a008049e249.html

www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7c5.html

www.cisco.com/en/US/products/sw/secursw/ps1018/products_implementation_design_guide09186a00800fd670.html

www.cisco.com/en/US/products/sw/iosswrel/ps5207/prod_bulletin09186a00801abfda.html

www.cisco.com/en/US/products/ps6441/prod_bulletin09186a00804a8728.html

www.cisco.com/en/US/products/ps6350/prod_bulletin09186a0080457a84.html

www.cisco.com/en/US/products/ps6350/products_feature_guide09186a008072c6e3.html

www.cisco.com/en/US/products/sw/secursw/ps1018/products_white_paper0900aecd806f31f9.shtml

VRF-Aware IOS Firewall

The Multiprotocol Label Switching Basic Clandestine Arrangement (MPLS VPN) affection allows several sites to interconnect

transparently through a account provider network. A account provider arrangement can abutment several IP VPNs. Anniversary of these

appears as a abstracted clandestine network. VRF is an IP acquisition table instance for abutting sites in a VPN network. Anniversary VPN

has its own set or sets of VRF instances, thereby acceptance anniversary armpit to accelerate IP packets to any added armpit in the aforementioned VRF

instance.

The Cisco IOS Firewall affection is added to abutment analysis for VRF instances in a MPLS VPN network. CBAC can inspect

packets on a per-VRF base for packets beatific and accustomed aural a VRF. VRF-aware CBAC accomplishing can include

multiple firewall instances (with VRF instances) that are allocated to abstracted VPN customers. VRF-aware CBAC provides

scalability and bargain affiliation after the charge for abstracted firewall accessories for anniversary VPN network. In effect, a single

physical router active assorted basic acquisition instances (emulating assorted routers) can now run assorted basic IOS

Firewalls in a distinct device.

This affection was alien in IOS Version 12.3(14)T.

Virtual Fragmentation Reassembly (VFR)

Before the accomplishing of the Virtual Fragmentation Reassembly (VFR) feature, the IOS Firewall (CBAC) could not

identify the capacity of the IP bits or accumulate any anchorage advice from the burst packets. This shortcoming

allowed all burst packets to bypass the firewall checks and get through the arrangement after actuality inspected.

Before the VFR affection was available, several accepted fragment-type attacks could succeed. (Examples accommodate Tiny Fragment

attack, Overlapping Fragment attack, and the Buffer Overflow advance that sends a ample cardinal of abridged IP fragments

to baffle the firewall.) The VFR affection provides the adequacy to browse into the burst packets to analysis the connection

information and actualize the agnate activating ACL entries, appropriately attention the arrangement from assorted fragmentation

attacks.

To accredit VFR, use the ip virtual-reassembly command from the interface agreement mode. Example 5-6 shows how to

configure VFR with a best cardinal of 100 IP datagrams to be reassembled at any accustomed time and a best number

of 20 bits accustomed per IP datagram (fragment set). The abeyance of 5 abnormal specifies that if all the fragment packets

are not accustomed aural the defined time, the IP datagram and all its bits will be dropped.

This affection was alien in IOS Version 12.3(8)T.

Example 5-6. Virtual Fragmentation Reassembly (VFR) Agreement Example

interface Fastethernet0/0

ip audit in | out

ip virtual-reassembly max-reassemblies 100 max-fragments 20 abeyance 5

Transparent IOS Firewall (Layer 2)

The cellophane IOS Firewall affection (also accepted as Layer 2 firewall) acts as a Layer 2 cellophane arch with CBAC

inspection configured on the Bridged Virtual Interface (BVI).

A Layer 3 IOS Firewall accomplishing requires two analytic zones—trusted and untrusted—both on altered IP subnets

(existing subnets). A arrangement accomplishing not advised to board this subnetted architectonics would crave the

redesign of IP subnets to board the firewall. Placing a Layer 3 firewall would be difficult in such scenarios and is

considered ability accelerated and could be absurd for best deployment scenarios.

Traditional firewalls accomplish in either a Layer 3 or Layer 2 (transparent) mode. The Cisco IOS Firewall is advised to

simultaneously interoperate in both modes, accouterment scalability and affluence of integration. This added functionality allows a

Cisco IOS Firewall to be implemented accordingly for both the Layer 2 cellophane firewall operating on the bridged packets

and a Layer 3 firewall operating on baffled packets on the aforementioned device.

The cellophane firewall agreement is no altered from the Layer 3 firewall application the ip audit command from the global

configuration mode. The CBAC analysis aphorism ip audit in/out command is activated to the bridged interfaces for Layer 2

protection, admitting added baffled interfaces are configured for Layer 3 protection.

This affection was alien in IOS Version 12.3(7)T.

E-Mail Analysis Engine

Similar to the SMTP protocol, the ESMTP agreement provides a basal adjustment for exchanging e-mail messages. ESMTP specifies

service extensions to the aboriginal SMTP agreement for sending e-mail letters that abutment graphics, audio, and video files,

and argument in assorted civic languages. Although an ESMTP affair is agnate to SMTP, there is one difference—the EHLO

command. An ESMTP applicant acknowledging ESMTP agreement starts a affiliation by arising the EHLO command instead of the

HELO command acclimated in accepted SMTP. (Refer to RFC 1869, "SMTP Service Extensions," for added details.)

The added SMTP analysis agent adds abutment for ESMTP, Post Office Agreement 3 (POP3), and Internet Message Access

Protocol (IMAP) in accession to the accepted SMTP protocol. Advanced appliance analysis prevents agreement masquerading

and administration austere RFC compliance.

To configure SMTP/ESMTP inspection, use the ip audit name inspection-name {smtp | esmtp } command from the

global agreement approach forth with added appropriate parameters. (Refer to accomplish authentic beforehand in the area "Configuring

CBAC .") This affection was alien in IOS Version 12.3(14)T.