Simple configuration of Context-Based Access Control

Technical characteristics:

1. Traffic filtering

CBAC checks not only the information of the network layer and the transport layer but also the information of the application layer.

It can also filter the http traffic and block java plug-in

2. Traffic monitoring

CBAC monitors the traffic passing through the router and handles the TCP and UDP state information which can be used to generate the temporary list to release the rebound traffic and other traffic allowed.

3. Alert and audit

4. Intrusion Prevention

【Lab Topology】

【Lab Process】

1. Configuration of GW

• Adjust the values of timeout and threshold:
• ip inspect tcp synwait-time seconds
• The default time is 30 seconds, if a TCP connection is not established within this time, this connection will be dropped out.
• ip inspect tcp finwait-time seconds
• The default time is 5 seconds, if a TCP connection is not established within this time, this connection will be dropped out.
• ip inspect tcp idle-time seconds
• The default time is 3600 seconds.
• ip inspect udp idle-time seconds
• The default time is 30 seconds. Monitor the UDP traffic and release the rebound UDP traffic within 30 seconds.
• ip inspect dns-timeout seconds
• The default time is 5 seconds. The DNS query time.
• ip inspect max-incomplete high number
• The default number is 500. If the number exceeds 500, the original Half-open connection will be deleted.
• ip inspect max-incomplete low number
• The default number is 400. Stop deleting if the number is lower than 400.
• ip inspect one-minute high number
• The default number is 500. Begin to delete the original Half-open connections when the new connection number is up to 500 within a minute.
• ip inspect one-minute low number
• The default number is 400. Stop deleting the original Half-open connections when the new connection number is lower than 400 within a minute.
• ip inspect tcp max-incomplete host number block-time minutes
• Control the number of the half-open connections based on the single host, the default is host 50 block-time 0.
• block-time = 0, if the TCP half-open connection number based on the single host exceeds the configured value, the oldest half-open connections will be cleared when there are new connection requests.
• block-time >0, when the TCP half-open connection number based on the single host exceeds the configured value, clear all the original half-open connections if there are new connection requests and block all the new connection requests within the block-time.

2. Test:

Telnet the outside router form the inside router and examine the generation of the list on the gateway router.

Configure logging: