| 3.3 |  | Context-based Access Control (CBAC) |
| 3.3.1 |  | ACL limitations |

| Before delving into CBAC, some basic ACL concepts need to be reviewed. The following are general statements about traditional ACLs:

- End in an implied deny any statement
- If not configured on an interface, all connections are permitted by default
- Provide traffic filtering at the network layer by utilizing the following:

- Source and destination IP addresses
- Source and destination ports

- Can be used to implement a filtering firewall
- Ports are opened permanently to allow traffic, creating a security vulnerability
- Do not work with applications that negotiate ports dynamically

CBAC
CBAC provides users with better protection from attacks. Figure lists the protocols supported by CBAC, describes the added alert and audit trail features, and lists the CBAC configuration tasks. CBAC creates temporary openings in access lists at firewall interfaces. These openings occur when specified traffic exits the internal network through the firewall. CBAC allows the traffic back through the firewall only if it is part of the same session as the original traffic that triggered CBAC when exiting the firewall.

The following tasks are involved in the configuration of CBAC. These tasks are explained throughout the rest of this module :

1. Set audit trails and alerts
2. Set global timeouts and thresholds
3. Define Port to Application Mapping(PAM)
4. Define inspection rules
5. Apply inspection rules and ACLs to interfaces
6. Test and verify