topic Cisco router IOS stateful inspection in Network Security

Cisco router IOS stateful inspection

Ruterford — Tue, 12 Mar 2019 02:00:40 GMT

Hi All,

Wondering if TCP state bypass can be applied on a Cisco router based IOS firewall (ip inspection)

Thanks!

lcambron — Wed, 19 Jun 2013 22:02:22 GMT

Hello,

TCP State Bypass in only on ASAs, I don't think there is something similar on CBAC(ip inspect).

You may need to migrate to ZBF.

With Zone Based Firewall, you can inspect,pass or drop traffic.

I hope it helps.

Regards,

Felipe.

Ruterford — Thu, 20 Jun 2013 15:14:10 GMT

Thanks for your reply.

Thinking on using reflexive ACL instead of stateful inspection.

Would it increase load on the CPU significantly?

I see that entry is created every time packet trespassing interface where the reflex access-list is in out state.

Even in both directions.

lcambron — Thu, 20 Jun 2013 22:30:18 GMT

Hi,

I'm not an expert on reflexive ACLs but I dont think this will increase much the cpu.

Regards,

Felipe.