Implementing Cisco IOS Firewalls参考.ppt

Cisco IOS Threat Defense Features Implementing Cisco IOS Firewalls Cisco IOS Firewall ConfigurationTasks Using the CLI Pick an interface: internal or external. Configure IP ACLs at the interface. Define inspection rules. Apply inspection rules and ACLs to interfaces. Test and verify. Set Audit Trails and Alerts Define Inspection Rules forApplication Protocols Apply an Inspection Rule to an Interface Guidelines for Applying InspectionRules and ACLs to Interfaces On the interface where traffic initiates: Apply ACL on the inward direction that permits only wanted traffic. Apply rule on the inward direction that inspects wanted traffic. On all other interfaces, apply ACL on the inward direction that denies all unwanted traffic. Example: Two-Interface Firewall Example: Three-Interface Firewall Verifying Cisco IOS Firewall Troubleshooting Cisco IOS Firewall Basic and Advanced Firewall Wizards SDM offers configuration wizards to simplify Cisco IOS Firewall configuration. Two configuration wizards exist: Basic Firewall Configuration wizard: Supports two interface types (Inside and Outside) Applies predefined rules Advanced Firewall Configuration wizard: Supports more interfaces (Inside, Outside, and DMZ) Applies predefined or custom rules Configuring a Basic Firewall Basic Firewall Interface Configuration Basic Firewall Configuration Summary and Deployment Reviewing the Basic Firewall for the Originating Traffic Reviewing the Basic Firewall for the Returning Traffic Resulting Basic Firewall Inspection Rule Configuration Resulting Basic Firewall ACL Configuration Resulting Basic Firewall Interface Configuration Configuring Interfaces onan Advanced Firewall Advanced Firewall Interface Configuration Advanced Firewall DMZService Configuration Advanced Firewall DMZService Configuration: TCP Advanced Firewall DMZService Configuration: UDP Advanced Firewall DMZService Configuration (Cont.) Advanced Firewall Security Policy Advanced Firewall Protocolsand Applications