Configuring context-based access control (cbac) - Packet tracer (russian)
Packet Tracer activity, Configuring Context-Based Access Control (CBAC), learners configure and IOS firewall with CBAC on a perimeter router. CBAC functionality is verified with ping, Telnet, and HTTP.
Playlist - • Cisco Packet Tracer Networking Tutorials
Website - http://www.ciscoarmenia.com/
Facebook - https://www.facebook.com/groups/netac...
Without CBAC, traffic filtering is limited to ACL implementations that examine packets at the Network Layer or, at most, the Transport Layer. CBAC relies on a stateful packet filter that is application-aware. This means that the filter is able to recognize all sessions of a dynamic application. CBAC examines not only Network Layer and Transport Layer information but also examines Application Layer protocol information (such as FTP connection information) to learn about the state of the session. For example, CBAC can monitor TCP, UDP, and ICMP connections and maintain information in a state table (or connection table) to keep track of these active sessions. This allows support of protocols that involve multiple channels created as a result of negotiations in the control channel. Most of the multimedia protocols as well as some other protocols (such as FTP, RPC, and SQL*Net) involve multiple channels.
The state table tracks the sessions and inspects all packets that pass through the stateful packet filter firewall. CBAC then uses the state table to build dynamic ACL entries that permit returning traffic through the perimeter router or firewall.
How does CBAC work? CBAC creates openings in ACLs at firewall interfaces by adding a temporary ACL entry for a specific session. These openings are created when specified traffic exits the internal protected network through the firewall. The temporary openings allow returning traffic that would normally be blocked and additional data channels to enter the internal network back through the firewall. The traffic is allowed back through the firewall only if it is part of the same session and has the expected properties as the original traffic that triggered CBAC when exiting through the firewall. Without this temporary ACL entry, this traffic would be denied by the preexisting ACL. The state table dynamically changes and adapts with the traffic flow.