IOS FirewallOutlineCBAC (Context-Based Access Control)CBAC FunctionalityHow does IOS maintain session state information?Other CBAC functionalityFeatures of IOS FirewallCase StudyIOS Firewall• IOS: Cisco’s Internetwork Operating System (the primary system running on Cisco’s routers)• IOS Firewall: a stateful packet-filter firewall that runs on a router, providing firewall capabilities• CBAC: Context-Based Access Control (at the core of the IOS Firewall functionalityhttp://sce.uhcl.edu/yang/teaching/.../IOS Firewalls.ppt2Outline•CBAC•IOS Firewall Features•Case studieshttp://sce.uhcl.edu/yang/teaching/.../IOS Firewalls.ppt3CBAC (Context-Based Access Control)•Implement packet filtering on a Cisco router (similar to ASA on Cisco PIX)•Three basic functionalities:1. Dynamic modification of the extended access lists–To allow connections initiated from the inside2. Inspection of the application/transport level protocols ~= multimedia support in PIX3. Control of the number/length of sessionshttp://sce.uhcl.edu/yang/teaching/.../IOS Firewalls.ppt4CBAC Functionality1. Set up Access Control Lists to open holes for inbound access to inside servers2. Set up the router to inspect outbound packets, and 3. Keep track of the associated sessions  i.e., a stateful packet filterhttp://sce.uhcl.edu/yang/teaching/.../IOS Firewalls.ppt5How does IOS maintain session state information?•State Information Structure (SIS)–A SIS is created for each logical session.–The SIS uniquely identifies a connection using the IP and the port#).–When necessary, other info such as TCP connection state, TCP sequence number, etc. are also maintained.–The SIS is deleted when the associated session/connection is terminated.http://sce.uhcl.edu/yang/teaching/.../IOS Firewalls.ppt6Other CBAC functionality•Out-of-sequence TCP packets are dropped.•TCP packets with invalid sequence numbers are dropped.•The reassembly of IP packets is not supported (as in PIX firewall).•Does not inspect packets originated by the IOS Firewall router.•ICMP packets are not inspected. (They are manually managed using static ACLs).•ICMP unreachable packets are ignored.•To protect against a flooding attack or unusual consumption of memory due to a large number of SISs:–when the number of SISs in the half-open state reaches a threshold, half-open SISs are deleted to accommodate a new session.–If the rate of new TCP connection requests is higher than a maximum value, half-open SISs are deleted for every new connection request.http://sce.uhcl.edu/yang/teaching/.../IOS Firewalls.ppt7Features of IOS Firewall•Transport Layer Inspection•Application Layer Inspection•Filtering for Invalid Commands•Java Blocking•Safeguarding against DOS attacks•Fragment handlinghttp://sce.uhcl.edu/yang/teaching/.../IOS Firewalls.ppt8Case Study•CBAC on a router configured with