• Chapter 1: Describing Network Requirements
• Chapter 2: Topologies for Teleworker Connectivity
• Chapter 3: Using Cable to Connect to a Central Site
• Chapter 4: Using DSL to Connect to a Central Site
• Chapter 5: Configuring DSL Access with PPPoE
• Chapter 6: Configuring DSL Access with PPPoA
• Chapter 7: DSL Connection Troubleshooting
• Chapter 8: The MPLS Conceptual Model
• Chapter 9: MPLS Architecture
• Chapter 10: Configuring Frame Mode MPLS
• Chapter 11: MPLS VPN Technologies
• Chapter 12: IPsec Overview
• Chapter 13: Site-to-Site VPN Operations
• Chapter 14: GRE Tunneling over IPsec
• Chapter 15: IPsec High Availability Options
• Chapter 16: Configuring Cisco Easy VPN
• Chapter 18: Cisco Device Hardening
• Chapter 19: Securing Administrative Access
• Chapter 20: Using AAA to Scale Access Control
• Chapter 21: Cisco IOS Threat Defense Features
• Chapter 22: Implementing Cisco IOS Firewalls
• Chapter 23: Implementing Cisco IDS and IPS

Chapter 22: Implementing Cisco IOS Firewalls

Cisco IOS Firewall Configuration

Step 1: Choose an interface to inspect

Apply ACL and inspection rules in the inbound direction on untrusted interfaces.

Step 2: Configure an ACL

Example to allow SMTP and HTTP inbound to their respective servers:

ip access-list extended FROM_OUTSIDE
 permit tcp any host 10.0.24.89 eq 25
 permit tcp any host 10.0.22.103 eq 80
 deny ip any any log

Step 3: Define the inspection rules

Router(config)# ip inspect name <name> <protocol> [alert {on | off}]
 [audit-trail {on | off}] [timeout <seconds>]

The default timeout between alerts is 10 seconds.

Step 4: Apply the ACL and inspection rule

Enable audit trail tracking via syslog:

Router(config)# ip inspect audit-trail
Router(config)# logging on

To turn on real-time alerts (default):

Router(config)# no ip inspect alert-off

Apply the ACL and inspect rule:

Router(config)# ip access-group FROM_OUTSIDE in
Router(config)# ip inspect SMTP-AND-HTTP in

Step 5: Verify the configuration

• show ip inspect [name <name> | config | interface | session | statistics | all]
• debug ip inspect ...