topic cbac set-up in Network Security

cbac set-up

mateomateo1 — Mon, 11 Mar 2019 23:11:38 GMT

Can I confirm with someone if that config of cbac will work:

cbac set-up

Jennifer Halim — Sat, 26 May 2012 00:39:40 GMT

Are you trying to allow inbound or outbound access on your access-list 121? From what i read, it seems more for outbound than inbound access, please kindly confirm.

If it's for outbound access, you would either need to apply the access-list on the LAN interface (in direction), or on the WAN interface (out direction).

cbac set-up

mateomateo1 — Sat, 26 May 2012 07:56:54 GMT

Hi Jennifer,

access-list 121 is for inbound access (from internet)

- access-group 121 in

inspect rule is applied on the same interface outbound

-ip inspect myfw out

cbac set-up

Jennifer Halim — Sat, 26 May 2012 12:24:59 GMT

OK, so you would like access initiated from the Internet towards your hosts/servers on all those ports listed in access-list 121?

cbac set-up

mateomateo1 — Sat, 26 May 2012 18:46:18 GMT

correct Jennifer access to those servers from acl 121 + alow all access from inside lan to the internet (with cbac)

cbac set-up

Jennifer Halim — Sat, 26 May 2012 19:34:19 GMT

ok thanks for confirming.

In that case, they all look good to me.

cbac set-up

mateomateo1 — Mon, 28 May 2012 08:18:48 GMT

Thank you Jennifer for confirming,

I have also another question about my second wan interface, I have 2 isp, wan2 is my vpn connection to branch office and wan1 is my internet access (with cbac on it - that is sorted now), now after wan1 is sorted I want also some sort of security on my vpn connection, what would be the best way to secure that connection, can I just apply

something like that on both sides ?

access-list 122 permit ip LAN1 LAN2

cbac set-up

Jennifer Halim — Mon, 28 May 2012 11:29:47 GMT

With access-list 122, you just have to permit the actual VPN traffic before decryption as follows:

access-list 122 permit esp host host

access-list 122 permit udp host host eq 500

access-list 122 permit udp host host eq 4500

cbac set-up

mateomateo1 — Thu, 07 Jun 2012 09:24:41 GMT

Would it be the best way of securing the router (interfaces) with the firewall? What can be done to secure it,

cbac set-up

Jennifer Halim — Thu, 07 Jun 2012 10:08:21 GMT

CBAC is one way to secure it, or you can also use ZBFW (Zone Base FW).

cbac set-up

mateomateo1 — Thu, 07 Jun 2012 10:42:56 GMT

Thank you Jennifer for all the answers, as regards to my firewall on vpn link (only acl) is that enough security?

cbac set-up

Jennifer Halim — Thu, 07 Jun 2012 11:02:56 GMT

Yes, that would be good enough as only IPSec VPN is allowed, and no other protocols.