Common Problems and Resolutions


This section looks into some of commonly asked questions and confusions regarding CBAC in a question-and-answer format.

1

Is load balancing possible with CBAC?

Answer:

Yes, if it is in the same router, but be sure to apply the same ACL on both the interfaces which participate in load-balancing the traffic.

2

With which features does the Cisco IOS Firewall not interoperate?

Answer:

The Cisco IOS Firewall does not interoperate with the following features: TCP intercept Asymmetric routing, where ingress and egress are two different routers; Load-balancing, where ingress and egress are two different routers.

Layer 4 and Layer 7 inspection of fragmented packets is not supported.

The Cisco IOS Firewall operation with Server Load Balancing (SLB) has not been tested.

3

Does CBAC work with standard ACL on the opposite direction of the CBAC inspection rule?

Answer:

No. Because the ACE in the ACL is created based on snm5-tuples which are based on Layer 4 information; you must have extended ACL configured so that ACE can be created by CBAC.

4

Does Cisco IOS Firewall work with fast switching?

Answer:

Yes, the firewall works with all high-performance switching modes that the platform supports, including Cisco Express Forwarding (CEF), flow, fast and process switching modes.

5

Does the firewall work with Channelized T1 by applying distinct policies to different channel groups?

Answer:

Yes. The same is true when distinct policies are applied to different Frame Relay subinterfaces.

6

Can non-IP protocols be routed while using Cisco IOS Firewall?

Answer:

Yes, other protocols such as Internetwork Packet Exchange [IPX] and AppleTalk can function alongside the firewall technology, but the firewall will not inspect associated traffic.



Cisco Network Security Troubleshooting Handbook
Cisco Network Security Troubleshooting Handbook
ISBN: 1587051893
EAN: 2147483647
Year: 2006
Pages: 190
Authors: Mynul Hoda

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net