1 cbac功能：

数据流过滤 数据流检查 警告和审计记录

2 任务：

选择接口--在接口上配置acl--配置全局的超时时间和阈值--定义检查规则--在接口上应用检查规则--配置日志和审计记录。

#基本安全

-----------------------------------------------

service password-encryption

enable secret cisco

no ip domain-lookup

no cdp run

line con 0

exec-timeout 2 0

password cisco

login

line aux 0

exec-timeout 2 0

password cisco

login

line vty 0 4

exec-timeout 2 0

password cisco

login

end

--------------------------------------------

#建立CBAC

ip inspect name block tcp

ip inspect name block ftp

ip inspect name block smtp

ip inspect name block h323

ip inspect name allow smtp

ip audit notify log

ip audit po max-events 100

call rsvp-sync

------------------------------------------------

access-list 101 deny ip host 255.255.255.255 any

access-list 101 deny ip 192.168.1.0 0.0.0.255 any

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any 192.168.1.0 0.0.0.255 time-extended

access-list 101 permit icmp any 192.168.1.0 0.0.0.255 packet-too-big

access-list 101 permit icmp any 192.168.1.0 0.0.0.255 traceroute

access-list 101 permit icmp any 192.168.1.0 0.0.0.255 unreachable

access-list 101 permit tcp any host 192.168.1.20 eq smtp

access-list 101 permit tcp any host 192.168.1.20 eq www

-------------------------------------------------------------

int fa0/0

ip add 10.0.0.1 255.255.255.0

ip access-group 101 in

ip inspect allow in

ip inspect block out

实列：

1 配置日志和审计追踪

logging on

loging 10.0.0.1

ip inspect audit-trail

2 定义和应用检查规则

定义检查tcp和ftp流量

ip inspect name snowwolf tcp timeout 300

ip inspect name snowwolf ftp timeout 300

定义访问控制列表允许出站的icmp和cbac流量，如ftp和www。阻塞其他内部发起的流量。

access-list 101 permit icmp any any

access-list 101 permit tcp 10.0.0.0 0.0.0.255 any eq ftp

access-list 101 permit tcp 10.0.0.0 0.0.0.255 any eq www

access-list 101 deny ip any any

定义访问控制列表允许入站的icmp和到内部的web和ftp服务器的cbac流量。

access-list 102 permit eigrp any any

access-list 102 permit icmp any any

access-list 102 permit tcp any host 10.0.0.12 eq ftp

access-list 102 permit tcp any host 10.0.0.12 eq www

access-list 102 deny ip any any

应用到接口

int fa0/1

de inside

ip inspect snowwolf in

ip access-group 101 in

exit

int fa0/0

de outside

ip access-group 102 in

1、CBAC：提供有状态的应用过滤，包括对非正式协议和多媒体应用的支持。它可以检查支持的连接，以发现内嵌的NAT、PAT