Cisco CISCO876-SEC-I-K9 Configuration Guide - Page 93

Chapter 8 Configuring a Simple Firewall Configure Access Lists Configure Access Lists Perform these steps to create access lists for use by the firewall, beginning in global configuration mode: Step 1 Command access-list access-list-number {deny | permit} protocol source source-wildcard [operator [port]] destination Example: Router(config)# access-list 103 deny ip any any Router(config)# access-list 103 permit host 200.1.1.1 eq isakmp any Router(config)# Purpose Creates an access list which prevents Internetinitiated traffic from reaching the local (inside) network of the router, and which compares source and destination ports. See the Cisco IOS IP Command Reference, Volume 1 of 4: Addressing and Services for details about this command. Configure Inspection Rules Perform these steps to configure firewall inspection rules for all TCP and UDP traffic, as well as specific application protocols as defined by the security policy, beginning in global configuration mode: Step 1 Command or Action ip inspect name inspection-name protocol Example: Router(config)# ip inspect name firewall tcp Router(config)# Purpose Defines an inspection rule for a particular protocol. Step 2 ip inspect name inspection-name protocol Example: Repeat this command for each inspection rule that you wish to use. Router(config)# ip inspect name firewall rtsp Router(config)# ip inspect name firewall h323 Router(config)# ip inspect name firewall netshow Router(config)# ip inspect name firewall ftp Router(config)# ip inspect name firewall sqlnet Router(config)# OL-5332-01 Cisco 850 Series and Cisco 870 Series Access Routers Software Configuration Guide 8-3