ccna 3 chapter 5 pdf

ccna 3 chapter 5 pdf.4.1.4 Configuring Established and Self-reversing ACLs for TCP4.1.4.1 First Generation Solutions for Stateful FirewallsOver the years, engineers have created many complex types of access control filters based on increasingly precise parameters. Engineers have also extended the scope of platforms and ACLs so that ACLs can be processed at wire speed. These enhancements to platforms and ACLs have allowed network security practitioners to implement advanced firewall solutions without sacrificing the performance of the network.In modern networks, network firewalls should be placed between the internal network and the external network. The basic idea is that all traffic coming in from the outside to the inside is denied, unless it is explicitly allowed by an ACL or originates back inside the network. This is the basic function of a network firewall, whether it is a dedicated hardware device or a Cisco router with an IOS firewall.Many common applications rely on TCP, which creates a virtual circuit between two endpoints. The first generation of IOS traffic filtering solutions supported the bidirectional nature of TCP virtual circuits by using the established keyword for extended IPACLs. Since 1995, it has been possible to build primitive network firewalls on Cisco routers using the established keyword of the extended IPACL. It blocks all traffic from the Internet except for TCP reply traffic associated with establishedTCP traffic (originating from inside the network), which is allowed.The second generation of IOS solutions for session filtering is the self-reversing ACL, which was introduced to IOS in 1996.This type of ACL filtering is based on source and destination address and port number filtering and can track sessions. Self-inverting ACL session filters use a temporary filter that is removed when the session ends.TCP's established option and self-reversing ACLs are both cases of complex ACLs.4.1.4.2 Monitoring TCP Tagging SettingsThe syntax of the TCP established option in a numbered extended IPACL is as follows.Router(config)#access-list(acl-#}{permit|deny}protocol source-addr [ source-wildcard ] [ operator