Context-Based Access Control (CBAC)

Logging

While it isn’t a CBAC feature, make sure logging is enabled and a syslog server is specified, so any incidents are properly logged for future reference.

Rtr1(config)#service timestamps log datetime Rtr1(config)#logging host Rtr1(config)#logging facility facility-type Rtr1(config)#logging trap level

The commands,—in order,—do the following:

1. Adds the date and time to syslog and audit-trail messages.

2. Defines the host name or IP address of the host to send syslog messages to.

3. Configures the syslog facility in which error messages are sent.

4. (Optional) Limits messages logged to the syslog servers based on severity. The default is level 7 (informational).

TCP Session Establishment Timer

Use the Global Configuration Mode command ip inspect tcp synwait-time to define the number of seconds the software will wait for a TCP session to reach the established state before dropping the session. The session is considered to have reached the established state after the session’s first SYN bit is detected. Use the no form of this command to reset the timeout to the default of 30 seconds. The syntax is

Rtr1(config)#ip inspect tcp synwait-time seconds
Rtr1(config)#no ip inspect tcp synwait-time

This command was introduced in IOS 11.2 P. The default is 30 seconds.

The value specified for this timeout applies to all TCP sessions inspected by CBAC.

TCP Session Termination Timer

Use the Global Configuration Mode command ip inspect tcp finwait-time to define how many seconds a TCP session will still be managed after the firewall detects a FIN-exchange. The FIN-exchange occurs when the TCP session is ready to close. Use the no form of the command to reset the timeout to the default of five seconds. The syntax is

Rtr1(config)#ip inspect tcp finwait-time seconds
Rtr1(config)#no ip inspect tcp finwait-time

This command was introduced in IOS 11.2 P. The default is five seconds.

The timeout set with this command is referred to as the finwait timeout. It applies to all CBAC-inspected TCP sessions.

TCP Session Inactivity Timer

Use the Global Configuration Mode command ip inspect tcp idle-time to specify the TCP idle timeout—the number of seconds a TCP session will still be managed after no activity. Use the no form of the command to reset the timeout to the default of 3,600 seconds (one hour). The syntax is

Rtr1(config)#ip inspect tcp idle-time seconds
Rtr1(config)#no ip inspect tcp idle-time

This command was introduced in IOS 11.2 P. The default is 3,600 seconds (one hour).

When CBAC detects a valid TCP packet that’s the first in a session for a protocol CBAC is inspecting, the software creates a new state table entry with the information. If no TCP packets for a particular session are detected for the time defined by the TCP idle timeout, the software drops that session entry from the state table and ACL.

This global value can be overridden for specific interfaces by defining a set of inspection rules with the Global Configuration Mode command ip inspect name. This command only applies the new timeout to any new or existing inspection rules that don’t have an explicitly defined timeout.

UDP Session Inactivity Timer

Use the Global Configuration Mode command ip inspect udp idle-time to specify the UDP idle timeout, the number of seconds a UDP “session” will still be managed after no activity. Use the no form of the command to reset the timeout to the default of 30 seconds. The syntax is

Rtr1(config)#ip inspect udp idle-time seconds Rtr1(config)#no ip inspect udp idle-time

This command was introduced in IOS 11.2 P. The default is 30 seconds.

When CBAC detects a valid UDP packet that’s the first in a session for a protocol CBAC is inspecting, the software creates a new state table entry with the information. Because UDP is a connectionless service, no actual sessions exist, so the software approximates sessions by examining the information in the packet and determining if the packet is similar to other UDP packets (for example, similar source/destination addresses) and if the packet was detected soon after another similar UDP packet.

Because UDP is a connectionless service, no actual sessions exist as with TCP, so CBAC approximates sessions. It does this by examining the packets and determining if they’re similar (source/destination addresses and ports) to other UDP packets. If no UDP packets for a particular session are detected for the time defined by the UDP idle timeout, the software drops those session entries from the state table and ACL.

This global value can be overridden for specific interfaces when you define a set of inspection rules with the Global Configuration Mode command ip inspect name. This command only applies the new timeout to any new or existing inspection rules that don’t have an explicitly defined timeout.

DNS Session Inactivity Timer

Use the Global Configuration Mode command ip inspect dns-timeout to specify the DNS idle timeout, the length of time a DNS-name lookup session will still be managed after no activity. Use the no form of the command to reset the timeout to the default of five seconds. The syntax is

Rtr1(config)#ip inspect dns-timeout seconds
Rtr1(config)#no ip inspect dns-timeout

This command was introduced in IOS 11.2 P. The default is five seconds.

When CBAC detects a valid UDP packet for a new DNS-name lookup session for a protocol CBAC is inspecting, the software creates a new state table entry with the information. If the software detects no packets for the DNS session for a time period defined by the DNS idle timeout, the software then drops that session entry from the state table and ACL.

The DNS idle timeout applies to all DNS-name lookup sessions inspected by CBAC and overrides the global UDP timeout. The DNS idle timeout value also enters Aggressive mode and overrides any timeouts specified for specific interfaces when you define a set of inspection rules with the ip inspect name command.

Maximum Incomplete Sessions High/Low Threshold

An unusually high number of half-open sessions can indicate a DoS attack is occurring. For TCP, half-open means that the session hasn’t reached the established state. For UDP, half-open means that the firewall has detected traffic from one direction only.

CBAC measures both the total number of existing half-open sessions and the rate of session establishment attempts. Both TCP and UDP half-open sessions are counted in the total number and rate measurements. Measurements are made once a minute.

When the number of existing half-open sessions rises above the threshold set by the ip inspect max-incomplete high command, the software then deletes half-open sessions until the number of existing half-open sessions drops below the threshold set by the ip inspect max-incomplete low command.

The global value specified for this threshold applies to all TCP and UDP connections inspected by CBAC.

Use the Global Configuration Mode command ip inspect max-incomplete high to define the number of existing half-open sessions that will cause the software to start deleting half-open sessions. Use the no form of the command to reset the threshold to the default of 500. The syntax is

Rtr1(config)#ip inspect max-incomplete high number
Rtr1(config)#no ip inspect max-incomplete high

This command was introduced in IOS 11.2 P. The default is 500 half-open sessions.

Use the Global Configuration Mode command ip inspect max-incomplete low to define the number of existing half-open sessions that will cause the software to stop deleting half-open sessions. Use the no form of the command to reset the threshold to the default of 400 half-open sessions. The syntax is

Rtr1(config)#ip inspect max-incomplete low number
Rtr1(config)#no ip inspect max-incomplete low

This command was introduced in IOS 11.2 P. The default is 400 half-open sessions.

The following example causes the CBAC to start deleting half-open sessions when the number of half-open sessions rises above 800 and to stop when the number drops below 500.

Rtr1(config)#ip inspect max-incomplete high 800
Rtr1(config)#ip inspect max-incomplete low 500

One Minute Incomplete Sessions High/Low Threshold

This is an extension of the preceding threshold, accelerating the process to respond to a rapid increase in incomplete sessions. These rate thresholds are measured as the number of new session connection attempts detected in the last one-minute sample period.

The global value specified for this threshold applies to all TCP and UDP connections inspected by CBAC.

Use the Global Configuration Mode command ip inspect one-minute high to define the number of new unestablished sessions that will cause the software to start deleting half-open sessions. Use the no form of the command to reset the threshold to the default of 500. The syntax is

Rtr1(config)#ip inspect one-minute high number
Rtr1(config)#no ip inspect one-minute high

This command was introduced in IOS 11.2 P. The default is 500 half-open sessions.

Use the Global Configuration Mode command ip inspect one-minute low to define the rate of new unestablished TCP sessions that will cause the software to stop deleting half-open sessions. Use the no form of this command to reset the threshold to the default of 400. The syntax is

Rtr1(config)#ip inspect one-minute low number
Rtr1(config)#no ip inspect one-minute low

This command was introduced in IOS 11.2 P. The default is 400 half-open sessions.

The following example causes the software to start deleting half-open sessions when more than 1,000 session establishment attempts are detected in the last minute and to stop when fewer than 750 sessions are detected in the last minute:

Rtr1(config)#ip inspect one-minute high 1000
Rtr1(config)#ip inspect one-minute low 750

Maximum Incomplete Sessions Per Destination Host Threshold

An unusually high number of half-open sessions with the same destination host address can indicate that a DoS attack is being launched against the host. Use the Global Configuration Mode command ip inspect tcp max-incomplete host to specify threshold and blocking time values for TCP host–specific DoS detection and prevention. Use the no form of the command to reset the threshold and blocking time to the default values. The syntax is

Rtr1(config)#ip inspect tcp max-incomplete host number block-time seconds
Rtr1(config)#no ip inspect tcp max-incomplete host

This command was introduced in IOS 11.2 P. The default is 50 half-open sessions and 0 minutes.

When the numbers of half-open sessions with the same destination host address rises above this threshold, CBAC will delete half-open sessions choosing a method based on the block-time seconds setting. If the timeout is

The software also sends syslog messages whenever the max-incomplete host number is exceeded and when blocking of connection initiations to a host starts or ends.

The global values specified for the threshold and blocking time apply to all TCP connections inspected by CBAC.

The following example changes the max-incomplete host number to 70 half-open sessions and changes the block-time timeout to 90 seconds.

Rtr1(config)#ip inspect tcp max-incomplete host 70 block-time 90

System-Defined Port Mapping

Initially, PAM creates a set of system-defined entries in the mapping table using well-known or registered port mapping information set up during the system startup. The Cisco IOS Firewall CBAC feature requires the system-defined mapping information to function properly. The system-defined mapping information can’t be deleted or changed. It isn’t possible to assign an application to an existing system-defined mapping, such as attempting to map HTTP services to port 25 (SMTP). The following table shows the well-known or registered port mapping information.

User-Defined Port Mapping

Network applications that use nonstandard ports require user-defined entries in the mapping table. Use the Global Configuration Mode command ip port-map to create user-defined entries ports to application mapping. Use the no form of the command to delete user-defined PAM entries. The command can’t be used to change system-defined port mappings. The syntax is

Rtr1(config)#ip port-map appl-name port port-num [list acl#]
Rtr1(config)#no ip port-map appl-name port port-num [list acl#]

This command was introduced in IOS 12.0(5)T. No default values.

This example shows PAM entries that define a range of nonstandard ports for HTTP services.

Rtr1(config)#ip port-map http port 8000
Rtr1(config)#ip port-map http port 8001
Rtr1(config)#ip port-map http port 8002

Host-Specific Port Mapping

User-defined entries in the mapping table can include host-specific mapping, which establishes port mapping information for specific hosts or subnets. In some situations, it might be necessary to override the default port mapping information for a specific host or subnet, including a system-defined default port mapping information. Use the list option for the ip port-map command to specify an ACL for a host or subnet that uses PAM.

In this example, a specific host uses port 8000 for FTP services. ACL 1 identifies the server address (192.168.0.100), while port 8000 is mapped with FTP services:

Rtr1(config)#access-list 1 permit 192.168.0.100
Rtr1(config)#ip port-map ftp port 8000 list 1

In the next example, the same port number is required by different services running on different hosts. Port 8000 is required for FTP services by host 192.168.0.100, while port 8000 is required for HTTP services by host 192.168.0.175. ACL 10 and ACL 2 identify the specific hosts, while PAM maps the ports with the services for each ACL.

Rtr1(config)#access-list 1 permit 192.168.0.100
Rtr1(config)#access-list 2 permit 192.168.0.175
Rtr1(config)#ip port-map ftp port 8000 list 1
Rtr1(config)#ip port-map http port 8000 list 2

This example shows a failed attempt to assign the RealAudio application to port 21, which is normally reserved for FTP services. Following that is the correct method to define the host using ACL 1. With this configuration, host(s) in List 1 won’t recognize FTP activity on port 21.

Rtr1(config)#ip port-map realaudio port 21
Rtr1(config)#Command fail: the port 21 has already been defined for
 ????????ftp by the system.
 ????????No change can be made to the system defined port mappings.
Rtr1(config)#access-list 1 permit 192.168.0.100
Rtr1(config)#ip port-map realaudio port 21 list 1 

Verify Port to Application Mapping

Use the Privileged EXEC Mode command show ip port-map to display the Port to Application Mapping (PAM) information. This command displays the port mapping information at the firewall, including the system-defined and user-defined information. Include the application name to display only the entries for that application. Include the port number to display only the entries for that port. The syntax is

Rtr1#show ip port-map [appl-name | port port-num]

This command was introduced in IOS 12.0(5)T.

The following example shows the port mapping information for FTP services:

Rtr1#show ip port-map ftp 
Default mapping: ftp ?????????????port 21 ?????????????????system defined
Host specific: ??ftp ?????????????port 1250 ??in list 1 ???user defined

TCP and UDP Inspection

Configuring TCP and UDP inspection will permit any TCP and UDP packets to enter the internal network through the firewall, even if the application-layer protocol isn’t configured to be inspected. TCP and UDP inspection doesn’t recognize application-specific commands or processes and might not permit all returning packets for that application. Any returning application packets with port numbers different than the exiting packet will be blocked.

Application-layer protocol inspection takes precedence over the TCP or UDP packet inspection. For example, with FTP inspection, all control channel information will be recorded in the state table, and all FTP traffic is permitted back through the firewall if the control channel information is valid for the state of the FTP session. Any TCP inspection in this case becomes irrelevant.

Generic TCP and UDP inspection is much like reflexive ACLs, in that the packets entering the network must exactly match an existing session. This match is based on having the same source/destination addresses and source/destination port numbers as the existing packet, except reversed. Otherwise, the inbound packets are blocked at the interface.

The following example causes the software to inspect TCP sessions and UDP sessions, and to specifically allow FTP and Real Audio traffic back through the firewall for existing sessions only. UDP traffic has the audit-trail feature on, while the FTP timeout is changed to three minutes.

Rtr1(config)#ip inspect name letusin tcp
Rtr1(config)#ip inspect name letusin udp audit-trail on
Rtr1(config)#ip inspect name letusin ftp timeout 180
Rtr1(config)#ip inspect name letusin realaudio-video

H.323 Inspection

If you want CBAC inspection to work with Microsoft NetMeeting 2.0 traffic, an H.323 application-layer protocol, it’s necessary also to configure inspection for TCP because NetMeeting 2.0 uses an additional TCP channel not defined in the H.323 specification. No special configuration options exist for H.323

To add Microsoft NetMeeting 2.0 inspection, it’s necessary to add only the following entry because TCP inspection is on in the initial example:

Rtr1(config)#ip inspect name letusin h323

HTTP Inspection (Java Blocking)

With the proliferation of Java applets available on the Internet, protecting networks from malicious applets has become a major concern to network managers. The Java blocking feature can be configured either to filter or to completely deny access to Java applets.

Java inspection enables Java applet filtering at the firewall. Java applet filtering distinguishes between trusted and untrusted applets by relying on a list of external sites you designate as “friendly.” If an applet is from a friendly site, the firewall allows the applet through. If the applet isn’t from a friendly site, the applet is blocked. Alternatively, you could permit applets from all sites, except sites specifically designated as “hostile.”

Java blocking uses only numbered standard access lists to define friendly and hostile external sites. ACL “permit” statements define traffic from friendly sites, while ACL “deny statements” define traffic from hostile sites. If Java blocking is defined using an ACL number and no matching ACL exists, all Java applets will be blocked.

Use the no form of the command to remove Java blocking from the inspection set. The syntax is

Rtr1(config)#ip inspect name inspection-name [http [java-list acl#]] [alert {on | off}]
[audit-trail {on | off}] [timeout seconds]

Rtr1(config)#no ip inspect name inspection-name http

The next example would add blocking of all Java applets to the inspection set.

Rtr1(config)#ip inspect name letusin http

If the next example was used instead, all Java applets would be blocked except those originating from the server 192.168.0.10.

Rtr1(config)#access-list 15 permit 192.168.0.10
Rtr1(config)#ip inspect name letusin http java-list 15

RPC Inspection

RPC inspection allows the specification based on program numbers. To define multiple program numbers, create multiple entries for RPC inspection, each with a different program number. If a program number is specified, all traffic for that program number is permitted. Any program number that isn’t specified will have all traffic for that program number blocked.

Use the no form of the command to remove RPC inspection from the inspection set. The syntax is

Rtr1(config)#ip inspect name inspection-name [rpc program-number number [wait-time
minutes]] [alert {on | off}] [audit-trail {on | off}] [timeout seconds]

Rtr1(config)#no ip inspect name inspection-name rpc

The following example adds two RPC program numbers to the inspection set.

Rtr1(config)#ip inspect name letusin rpc program-number 100002
Rtr1(config)#ip inspect name letusin rpc program-number 100010

Fragment Inspection (DoS Attacks)

CBAC inspection rules can help protect hosts against DoS attacks involving fragmented IP packets. Even if the firewall prevents an attacker from completing a connection to a protected host, the attacker might still be able to disrupt services provided by that host in two ways: by sending a large number of “noninitial” IP fragments or by sending a complete set of fragmented packets through a router that has an ACL that filters out the first fragment of the packet. Either way, the remaining fragments can tie up host resources as it tries in vain to reassemble the incomplete packets.

Using fragmentation inspection, the CBAC maintains an interfragment state for IP traffic. Noninitial fragments are discarded unless the corresponding initial fragment has already been permitted to pass through the firewall. Noninitial fragments received before the corresponding initial fragments are discarded. Because many circumstances exist that can cause out-of-order delivery of legitimate fragments, fragmentation inspection can have a severe performance implications. For this reason, fragment inspection is off by default.

Use the no form of the command to remove fragment inspection from the inspection set. The syntax is

Rtr1(config)#ip inspect name inspection-name fragment [max number timeout seconds]

Rtr1(config)#no ip inspect name inspection-name fragment

Even if the system is under heavy attack from fragmented packets, legitimate fragmented traffic, if any, will still get some fraction of the firewall’s fragment state resources and, more important, regular unfragmented traffic can pass through the firewall unimpeded.

The following example adds fragment checking to that software inspection set. The firewall will allocate 100 state structures, meaning 100 initial fragments for 100 different packets sent through the router can be stored before new ones must be discarded. The timeout value for dropping unassembled packets is set to four seconds.

Rtr1(config)#ip inspect name letusin fragment max 100 timeout 4

SMTP Inspection

SMTP inspection searches SMTP commands for illegal commands. Packets with illegal commands are dropped, and the SMTP session will hang and eventually time out. An illegal command is any command except for the following legal commands: DATA, EXPN, HELO, HELP, MAIL, NOOP, QUIT, RCPT, RSET, SAML, SEND, SOML, and VRFY.

Use the no form of the command to remove fragment inspection from the inspection set. The syntax is

Rtr1(config)#ip inspect name inspection-name smtp [alert {on | off}] [audit-trail {on | off}] [timeout seconds]
Rtr1(config)#no ip inspect name inspection-name smtp

The following example adds SMTP inspection with default audit-trail and alert setting.

Rtr1(config)#ip inspect name letusin smtp