| 3.4 |  | Configure CBAC (Task 1 and 2) |
| 3.4.2 |  | Global timeouts and thresholds |

| CBAC uses timeouts and thresholds to determine how long to manage state information for a session, and to determine when to drop sessions that do not become fully established. These timeouts and thresholds apply globally to all sessions. It is possible to use the default timeout and threshold values, or change to values more suitable to the security requirements of the network. Any changes to the timeout and threshold values should be made before continuing to configure CBAC .

Four types of timeouts and thresholds will be discussed:

1. TCP, SYN, and FIN Wait Times
2. TCP, UDP, and DNS Idle Times
3. Global Half-Open Connections Limit
4. Half-Open Connection Limits by Host

TCP, SYN, and FIN wait times
To define how long the software will wait for a TCP session to reach the established state before dropping the session, use the i p inspect tcp synwait-time global configuration command. Use the no form of this command to reset the timeout to the default. The syntax of the ip inspect tcp synwait-time command is shown in Figure .

To define how long a TCP session will still be managed after the firewall detects a FIN exchange, use the ip inspect tcp finwait-time global configuration command. Use the no form of this command to reset the timeout to default. The syntax of the ip inspect tcp finwait-time command is shown in Figure .

TCP, UDP, and DNS idle times
To specify the TCP idle timeout, or the length of time a TCP session will still be managed after no activity, use the ip inspect tcp idle-time global configuration command. Use the no form of this command to reset the timeout to default.

To specify the UDP idle timeout, or the length of time a UDP session will still be managed after no activity, use the ip inspect udp idle-time global configuration command. Use the no form of this command to reset the timeout to default. The syntax for the ip inspect {tcp | udp} idle-time commands is shown in Figure .

To specify the DNS idle timeout, or the length of time a DNS name lookup session will still be managed after no activity, use the ip inspect dns-timeout global configuration command. Use the no form of this command to reset the timeout to the default. The syntax for the ip inspect dns-timeout command is shown in Figure .

Global half-open connections limit
Global Half-Open Connections Limit can be utilized to counteract DoS attacks. Global Half-Open Connections Limit will be discussed later in this module.

Half-open connection limits by host
Half-Open Connection Limits by Host can also be utilized to counteract DoS attacks against a specific host. Half-Open Connections Limits will be discussed later in this module.

| Web Links TCP Performance: http://www.cisco.com/en/US/about/ ac123/ac147/ac174/ac196/about_cisco _ipj_archive_article09186a00800c8417.html