| 2.3 |  | Securing the Perimeter Router |
| 2.3.6 |  | Cisco IOS firewall |

| Even though the Cisco IOS software provides many security mechanisms such as the commands discussed in the previous sections, it does not provide a complete shield against attacks. However, the Cisco IOS Firewall is a security specific software image option for Cisco routers. It integrates firewall functionality, authentication proxy, and intrusion detection . The Firewall Feature Set is now available for most Cisco routers including the 800, 1600, 1700, 2500, 2600, 3600, 7100, and 7200 series routers . It adds greater depth and flexibility to existing security solutions, such as authentication, encryption, and failover, by delivering stateful, application-based filtering, dynamic per-user authentication and authorization, defense against network attacks, Java blocking, and real-time alerts.

The Cisco IOS Firewall can operate in conjunction with other technologies such as Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol (L2TP), and Quality of Service (QoS). Three primary security components of the Cisco IOS Firewall are introduced in the following sections:

- Context-Based Access Control (CBAC)
- Authentication Proxy
- Intrusion Detection

CBAC will be discussed in greater detail later in Module 3. Authentication proxy and intrusion detection for routers will be discussed in Modules 4 and 5, respectively.

Context-based Access Control (CBAC)
The Cisco IOS Firewall Context-based Access Control (CBAC) engine provides secure, per-application access control across network perimeters. CBAC enhances security for TCP and UDP applications that use well-known ports, such as FTP and e-mail traffic, by scrutinizing source and destination addresses. CBAC allows network administrators to implement firewall intelligence as part of an integrated, single-box solution.

For example, sessions with an extranet partner involving Internet applications, multimedia applications, or Oracle databases would no longer need to open a network doorway accessible through weaknesses in a partner network. CBAC enables tightly secured networks to run basic application traffic, as well as advanced applications such as multimedia and videoconferencing, securely through a router.

Authentication proxy
Network administrators can create specific security policies for each user with Cisco IOS Firewall LAN-based, dynamic, per-user authentication and authorization. Previously, user identity and related authorized access were determined by a user’s fixed IP address, or a single security policy had to be applied to an entire user group or subnet. Now, per-user policy can be downloaded dynamically to the router from a Terminal Access Controller Access Control System (TACACS) or Remote Access Dial-In User Service (RADIUS) authentication server running authentication, authorization, and accounting (AAA) services.

Users can log on to the network or access the Internet through HTTP, and their specific access profiles will automatically be downloaded. Authentication and authorization can be applied to the router interface in either direction to secure inbound or outbound extranet, intranet, and Internet usage.

Intrusion detection
Intrusion detection systems (IDSs) help protect the network from internal and external attacks and threats. IDS technology enhances perimeter firewall protection by detecting and taking appropriate actions on packets and flows that violate the security policy or represent malicious network activity. This allows network administrators to automatically respond to threats from internal or external hosts.

| Media Activity Demonstration Activity: Cisco IOS Firewall versus PIX Security Appliance In this activity, students will compare the Cisco IOS Firewall to the PIX Security Appliance.