CCNA Security: IPS Controlling Application Access Lab

Lab Setup

• Make the connection as per the topology diagram above.
• Use the IP addressing chart below to assign IP address to the routers.
• All three routers are configured with RIPv2. And can ping each other.

IP Addressing Schema

Lab Objectives

1. Configure R2, that only allows for the following traffic through the S0/1(Outside Network) interface:

• SMTP traffic that originates from the inside networks.
• Only Java applets from network 1.1.1.0 /24 should be down loaded. Ensure that audit trail logging and real time alerts are enabled for this inspection.
• Allows Net-Meeting traffic that originates from the inside networks.
• Allowing routing traffic for RIPv2 and ICMP should function properly.

R2 Configuration

R2(config)#access-list 1 permit 1.1.1.0 0.0.0.255

R2(config)#access-list 100 permit icmp any any

R2(config)#access-list 100 permit udp any any eq rip

R2(config)#ip inspect name FIREWALL http java-list 1 alert on audit-trail on

R2(config)#ip inspect name FIREWALL smtp

R2(config)#ip inspect name FIREWALL h323 (Note: – h323 protocol is used for MS NetMeeting, Intel Video Phone)

R2(config)#int s0/1

R2(config-if)#ip inspect FIREWALL out

R2(config-if)#ip access-group 100 in

Key Points to Remember

• The access-list for the Java applets must be standard.
• If the access-list does not exist, all Java applets from all address will be blocked.
• IOS Firewall does not detect or block encapsulated Java applets such as applets in “.zip” format.
• IOS Firewall does not detect or block applets loaded via FTP, Gopher or HTTP on a non-standard port.

Verification

R2#show ip inspect all

Session audit trail is disabled

Session alert is enabled

one-minute (sampling period) thresholds are