Permitting Or Denying Traffic With Access Lists; Applying Nat; Protecting From Ip Fragments; Using Aaa For Through Traffic - Cisco 7604 Configuration Manual
Catalyst 6500 series switch and cisco 7600 series router firewall services module configuration guide using the cli
Hide thumbs
Also See for 7604:
- Configuration manual (1011 pages) ,
- Installation manual (324 pages) ,
- User manual (98 pages)
Table of Contents
Advertisement
Security Policy Overview
•
•
•
•
Permitting or Denying Traffic with Access Lists
You can apply an access list to allow traffic through an interface. For transparent firewall mode, you can
also apply an EtherType access list to allow non-IP traffic.
Applying NAT
Some of the benefits of NAT include the following:
•
•
•
Protecting from IP Fragments
The FWSM provides IP fragment protection. This feature performs full reassembly of all ICMP error
messages and virtual reassembly of the remaining IP fragments that are routed through the FWSM.
Fragments that fail the security check are dropped and logged. Virtual reassembly cannot be disabled.
Using AAA for Through Traffic
You can require authentication and/or authorization for certain types of traffic, for example, for HTTP.
The FWSM also sends accounting information to a RADIUS or TACACS+ server.
Applying Internet Filtering
Although you can use access lists to prevent outbound access to specific websites or FTP servers,
configuring and managing web usage this way is not practical because of the size and dynamic nature of
the Internet. We recommend that you use the FWSM in conjunction with a separate server running one
of the following Internet filtering products:
•
•
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
1-4
Using AAA for Through Traffic, page 1-4
Applying Internet Filtering, page 1-4
Applying Application Inspection, page 1-5
Applying Connection Limits, page 1-5
You can use private addresses on your inside networks. Private addresses are not routable on the
Internet.
NAT hides the local addresses from other networks, so attackers cannot learn the real address of a
host.
NAT can resolve IP routing problems by supporting overlapping IP addresses.
Websense Enterprise
Sentian by N2H2
Chapter 1
Introduction to the Firewall Services Module
OL-20748-01
- Quick Links:
- C H a P T E...
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
