CBAC Firewall Locations

[rasoftware]

Am I better to place the CBAC inspection on the outside "out" or inside "in" interface?

Is there a rule as with standard and exteneded ACLs?

[pkhatri]

Hi,

The general rule with filtering is to filter as early as possible. However, your circumstances will dictate whether you place it on the inside or the outside interface.

Paresh

[rasoftware]

I'm guessing unless I need specific inspections for the inside "in" ie DMZ and LAN I would be better putting this on the outside "out" to prevent un-necessary traffic coming into the router then getting dropped?

I ask because I inherited two routers on a new network, one seems to filter on LAN other onthe outside.

[pkhatri · Accepted solution]

Yes, I would also think that it's better to apply it in the outside interface because that is more likely to be the point of entry for malicious traffic.

Paresh