| 3.2 |  | Types of IP ACLs |
| 3.2.10 |  | Context-based Access Control |

| Context-based Access Control (CBAC) inspects traffic that travels through the firewall to discover and manage state information for TCP and UDP sessions. This state information is used to create temporary openings in the firewall access lists. This is done by configuring ip inspect lists in the direction of the flow of traffic initiation to allow return traffic and additional data connections for permissible sessions. Permissible sessions are sessions that originated from within the protected internal network.

The following is the syntax for CBAC:

ip inspect name inspection-name protocol [timeout seconds]

Figure illustrates an example of using CBAC to inspect outbound traffic. Extended ACL 111 would normally block the return traffic, other than ICMP without CBAC opening holes for the return traffic.