| Overview

The first two modules introduced students to network security and general router security. This module will discuss, in greater detail, how routers are utilized to secure a network through the use of Access Control Lists (ACLs) and Context-based Access Control (CBAC).

ACLs are used to filter and secure network traffic. ACLs filter network traffic by controlling whether routed or switched packets are forwarded or blocked at the interface. Each packet is examined to determine how that packet should be handled based on the criteria specified within the ACL. Students are introduced to several types of ACLs and given examples of each type. How ACLs are applied and edited will also be discussed. Students will also gather practical experience through several labs that cover ACL types.

One particular type of ACL, CBAC is discussed in great detail. CBAC provides a greater level of security among the ACLs by inspecting traffic at Layers 3 and higher. Information gathered by CBAC is used to create temporary openings in the firewall access lists. The student will learn the six steps required to create and establish CBAC:

1. Set audit trails and alerts
2. Set global timeouts and thresholds
3. Define Port to Application Mapping (PAM)
4. Define inspection rules
5. Apply inspection rules and ACLs to interfaces
6. Test and verify

In addition to applied ACLs, CBAC has several other uses. Packets entering the firewall are only inspected by CBAC if they first pass the inbound ACL at the interface. If a packet is denied by the ACL, the packet is simply dropped and not inspected by CBAC.

NOTE: It is required that the student study the commands covered in the chapter using the labs and the command reference. Not all required commands are covered in sufficient detail in the text alone. Successful completion of this course requires a thorough knowledge of command syntax and application.