| 3.7 |  | Task 5: Inspection Rules and ACLs Applied to Router Interfaces |
| 3.7.1 |  | Applying inspection rules and ACLs |

| Now that Inspection rules and how to configure them have been discussed, it is important to understand how they are applied to interfaces on the router. Remember, no inspection rule or ACL can become effective until it is applied to a router interface. This section looks at the guidelines for applying inspection rules to the inside and outside interfaces of the router and also discusses the commands needed to do this. Additionally, two detailed examples are provided at the end of this section to better illustrate how inspection rules work. The first example looks at a simple topology that has a perimeter router with two interfaces, one going to the internal network and one to the Internet. The second example adds a third interface to the perimeter router, which connects the DMZ.

General Rules
For the Cisco IOS Firewall to be effective, both inspection rules and ACLs must be strategically applied to all the router interfaces. The following are some general rules for applying inspection rules and ACLs on the router:

- On the interface where traffic initiates, apply the ACL on the inward direction that only permits wanted traffic. Apply the rule on the inward direction that inspects wanted traffic.
- On all other interfaces, apply the ACL on the inward direction that denies all traffic, except traffic not inspected by CBAC, such as ICMP.

To apply a set of inspection rules to an interface, use the ip inspect interface configuration command. Use the no form of this command to remove the set of rules from the interface. The syntax for the ip inspect command is shown in Figure .