Cisco Systems OL-6426-02 manual Configure Access Lists, Configure Inspection Rules

Chapter 8 Configuring a Simple Firewall

Configure Access Lists

BETA DRAFT - CISCO CONFIDENTIAL

Configure Access Lists

Perform these steps to create access lists for use by the firewall, beginning in global configuration mode:

	Command	Purpose
Step 1	access-list access-list-number{deny permit}	Creates an access list which prevents Internet-
	protocol source source-wildcard [operator [port]]	initiated traffic from reaching the local (inside)
	destination	network of the router, and which compares
		source and destination ports.
	Example:	See the Cisco IOS IP Command Reference,
	Router(config)# access-list 103 permit host	Volume 1 of 4: Addressing and Services for
	200.1.1.1 eq isakmp any	details about this command.
	Router(config)#
Step 2
	access-list access-list-number{deny permit}	Creates an access list that allows network traffic
	protocol source source-wildcard destination	to pass freely between the corporate network
	destination-wildcard	and the local networks through the configured
		VPN tunnel.
	Example:

Router(config)# access-list 105 permit ip

10.1.1.00.0.0.255 192.168.0.0 0.0.255.255 Router(config)#

Configure Inspection Rules

Perform these steps to configure firewall inspection rules for all TCP and UDP traffic, as well as specific application protocols as defined by the security policy, beginning in global configuration mode:

	Command or Action	Purpose
Step 1
	ip inspect name inspection-name protocol	Defines an inspection rule for a particular
		protocol.
	Example:
	Router(config)# ip inspect name firewall tcp
	Router(config)#
Step 2
	ip inspect name inspection-name protocol	Repeat this command for each inspection rule
		that you wish to use.
	Example:
	Router(config)# ip inspect name firewall rtsp
	Router(config)# ip inspect name firewall h323
	Router(config)# ip inspect name firewall
	netshow
	Router(config)# ip inspect name firewall ftp
	Router(config)# ip inspect name firewall
	sqlnet
	Router(config)#

Cisco 1800 Series Integrated Services Routers (Fixed) Software Configuration Guide

OL-6426-02 8-3