| 3.6 |  | Task 4: Define Inspection Rules |
| 3.6.1 |  | Overview of inspection rules |

| CBAC allows for traffic to be inspected at the session and application layers of the OSI model. However, for CBAC to work, it must know what traffic to inspect. Inspection rules are used to define the applications that are to be inspected by CBAC. This section will discuss inspection rules and how they are configured for Java, RPC applications, SMTP applications, and IP Packet Fragmentation .

Inspection rules must be defined to specify what IP traffic, or which application-layer protocols, will be inspected by CBAC at an interface. Normally, only one inspection rule is defined. The only exception might occur if CBAC is enabled in two directions at a single firewall interface. In this case two rules must be configured, one for each direction.

An inspection rule should specify each desired application-layer protocol, as well as generic TCP or generic UDP, if desired. The inspection rule consists of a series of statements, each listing a protocol and specifying the same inspection rule name. Inspection rules also include options for controlling alert and audit trail messages and for checking IP packet fragmentation.