topic Re: Statefull Packet Inspection in Network Security

Statefull Packet Inspection

ashish.sehgal — Mon, 11 Mar 2019 14:50:53 GMT

Can Cisco2821 and Cisco2811 routers support Stateful Packet Inspection. If yes, how to configure it? If No, kindly provide supporting documents/links etc.

Thanks and Regards,

Ashish

Re: Statefull Packet Inspection

ashish.sehgal — Mon, 16 Feb 2009 11:10:58 GMT

Dear All,

I found that SPI is configurable on Cisco2821 router. Could you let me know:

Is Statefull Packet Inspection (SPI) and CBAC (Context Based Access Control) are one and the same thing?

Regards

Re: Statefull Packet Inspection

ashish.sehgal — Fri, 20 Feb 2009 04:53:53 GMT

I have prepared a template to configure Stateful Packet Inspection on Cisco 2821. Would appreciate if any volunteer can validate the template.

Thanks a lot.

Regards,

Ashish

Re: Statefull Packet Inspection

vikram_anumukonda — Sun, 22 Feb 2009 12:57:31 GMT

you will have to replace the "echo-reply" with "echo" in access-list 100 for a start, without which you will not be able to initiate a ping from unprotected networks.

and permit for ftp-data 20 , i don't think it's required as you are inspecting ftp connections originating from your protected network. Rest everything looks fine.

Re: Statefull Packet Inspection

ashish.sehgal — Mon, 23 Feb 2009 06:44:42 GMT

Hi Vikram,

Is the application of the ACL and the Inspection rule on the Outside and Inside interfaces respectively in inbound direction, correct ?

Thanks,

Ashish

Re: Statefull Packet Inspection

vikram_anumukonda — Mon, 23 Feb 2009 08:09:55 GMT

Hi Ashish,

The directions are correct, the inspections configured inbound are going to punch holes in the ACL 100 to accomodate the return traffic.

Vikram