IOS Firewall

IOS: Ciscos Internetwork Operating System (the primary system running on Ciscos routers) IOS Firewall: a stateful packet-filter firewall that runs on a router, providing firewall capabilities CBAC: Context-Based Access Control (at the core of the IOS Firewall functionality

Outline
CBAC IOS Firewall Features Case studies

http://sce.uhcl.edu/yang/teaching/. ../IOS Firewalls.ppt

CBAC (Context-Based Access Control)

Implement packet filtering on a Cisco router (similar to ASA on Cisco PIX) Three basic functionalities:
1. Dynamic modification of the extended access lists
To allow connections initiated from the inside

2. Inspection of the application/transport level protocols ~= multimedia support in PIX 3. Control of the number/length of sessions
http://sce.uhcl.edu/yang/teaching/. ../IOS Firewalls.ppt 3

CBAC Functionality
1. Set up Access Control Lists to open holes for inbound access to inside servers 2. Set up the router to inspect outbound packets, and 3. Keep track of the associated sessions i.e., a stateful packet filter

http://sce.uhcl.edu/yang/teaching/. ../IOS Firewalls.ppt

How does IOS maintain session state information?

State Information Structure (SIS)
A SIS is created for each logical session. The SIS uniquely identifies a connection using the IP and the port#). When necessary, other info such as TCP connection state, TCP sequence number, etc. are also maintained. The SIS is deleted when the associated session/connection is terminated.

http://sce.uhcl.edu/yang/teaching/. ../IOS Firewalls.ppt

Other CBAC functionality

Out-of-sequence TCP packets are dropped. TCP packets with invalid sequence numbers are dropped. The reassembly of IP packets is not supported (as in PIX firewall). Does not inspect packets originated by the IOS Firewall router. ICMP packets are not inspected. (They are manually managed using static ACLs). ICMP unreachable packets are ignored. To protect against a flooding attack or unusual consumption of memory due to a large number of SISs:
when the number of SISs in the half-open state reaches a threshold, half-open SISs are deleted to accommodate a new session. If the rate of new TCP connection requests is higher than a maximum value, half-open SISs are deleted for every new connection request.
http://sce.uhcl.edu/yang/teaching/. ../IOS Firewalls.ppt 6

Features of IOS Firewall

Transport Layer Inspection Application Layer Inspection Filtering for Invalid Commands Java Blocking Safeguarding against DOS attacks Fragment handling

http://sce.uhcl.edu/yang/teaching/. ../IOS Firewalls.ppt

Case Study
CBAC on a router configured with NAT

http://sce.uhcl.edu/yang/teaching/. ../IOS Firewalls.ppt