| 3.8 |  | Task 6: Test and Verify CBAC |
| 3.8.3 |  | Configure a null interface |

| The benefits of access lists or CBAC cannot come without a price. Applying an access list to an interface forces the router to check each packet that passes through it, resulting in increased latency. In some cases, a network can be secured without impacting performance. To restrict all traffic to a particular destination, configure a static route to null0. The null0 interface is a software-only interface that functions as a destination for discarded information. In a sense, null0 is a garbage bin. For example, instead of using an access list to filter traffic destined for network 10.0.0.0/8, configuring a static route to null0 with the following command will yield the same result:

router(config)#ip route 10.0.0.0 255.0.0.0 null0

The router will install a route to the 10.0.0.0/8 network into its routing table. That route points to null0. Therefore, when the router receives traffic destined for 10.0.0.0/8, it will perform a table lookup, find the route, and send the packets to null0.

Static routes to null0 can be used as traffic filters only when it is desired to completely prohibit a destination network. Filtering based on source addresses would have to be done using a route map.

Figure compares filtering with an access list to filtering with a route to null0 . A route to null0 makes far fewer demands on the router CPU. There are no access lists statements that must be matched upon receiving the packet. As a result, traffic destined for 10.0.0.0/8 cannot pass through the router because the packet is routed to nowhere.

| Lab Activity e-Lab Activity: Configure CBAC on a Cisco Router In this activity, students will configure logging and audit trails, define and apply inspection rules ACL, and test and verify CBAC.

| Lab Activity Lab Activity: Configure Cisco IOS Firewall CBAC on a Cisco Router In this lab, students will complete the following tasks:

- Configure logging and audit trails
- Define and apply inspection rules and ACLs
- Test and verify CBAC