Cisco Systems OL-4015-08 Select Inspection Rule, Protocol, Alert, Audit Trail

Chapter5 Create Firewall
Advanced Firewall Configuration Wizard
5-8
Cisco Router and Security Device Manager Version 2.2 User’s Guide
OL-4015-08
traffic onto the network. These rules cause the router to examine outgoing packets
for specified types of traffic. Traffic arriving at the outside interface is compared
against the traffic types in the inspection rule, and allowed onto the network if it
associated with a session started on the LAN and is of a type specified in the
inspection rules. In this way, inspection rules create temporary holes in the
firewall so that hosts on the LAN can receive return traffic.
This screen shows you the default inspection rule that SDM provides, plus any
user-configured inspection rules, and enables you to add or modify
user-configured inspection rules.
An inspection rule is a named list of inspection rule entries. Each entry consists
of a protocol specification, an alert switch, and an audit switc h.
Select Inspection Rule
Select the inspection rule whose entries you want to view.
Protocol
The protocol that this entry will inspect. For example, if the protocol FTP is
specified, the rule inspects incoming FTP traffic if it is associated with a session
started from inside the firewall.
Alert
On if the router is to generate alerts when traffic of this type is encountered. Off
if no alert is to be generated. Alerts will be saved in a syslog file if syslog has been
enabled in the Router Properties Logging window.
Audit Trail
On if the router is to generate an audit trail when traffic of this type is
encountered. Off if no audit trail is to be generated. Audit trails will be saved in a
syslog file if syslog has been enabled in theRouter Properties Logging win dow.