CBAC vs. Established

[viorel.spinu]

Hello,

can somebody tell me in a few words what is the diffrence between CBAC and established !

From my point of view is practicaly the same thing. Why should I use one and not the other ?

Thank U!

[Jon Marshall]

viorel.spinu wrote:
Hello,
can somebody tell me in a few words what is the diffrence between CBAC and established !
From my point of view is practicaly the same thing. Why should I use one and not the other ?
Thank U!

CBAC is a stateful firewall. It is keeping check of sessions with the TCP flags, sequence numbers etc. It can look at a connection as a whole ie. it knows that traffic coming back with the TCP ACK flag set with a src/dst IP and src/dst port that matches a packet sent out is part of the same connection.

The established keyword simply looks for a TCP flag in the packet. It doesn't look at sequence numbers and it has no knowledge of the connection only individual packets.

So a packet is sent from the outside with the ACK flag set. But this packet does not correspond to any packet that was sent out from the inside.

CBAC will drop the packet.

The established keyword will allow it in because it has the right TCP flag.

Jon

[Mohamed Sobair]

Hi,

CBAC intelligently filter TCP and UDP packets based on the Application layer session information. CBAC builds temporary opening to allow Data and return traffic to pass through the firewall.

Established looks at the TCP packets and checks whether the TCP established bit flag is set or not.

for example: If you want to allow ICMP from th inside network to the outside network but not the opposite way around, you will need to have CBAC inspecting the traffic inbound direction , access-list should be allowing the traffic, CBAC will then allow the return traffic to pass even though you could have access-list dening ICMP from the outside to the inside Network.

With Established, you could deny or allow only TCP packets that have established bit set using normal Access-list

HTH

Mohamed

[keller.oliver]

CBAC is true stateful firewalling, which means session tracking of TCP connections (ie reading 3-way handshakes and tearing down via FIN or RST) and timer based session tracking of sessionless protocols like UDP.

From http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtaclflg.html :

established

(Optional) For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK or RST bit set. The nonmatching case is that of the initial TCP datagram to form a connection.

Problem with establish is : You can use packet generators that produce packets with the corresponding bits set, so to an ordinary ACL with established this packet would appear correct, although it isn´t.

HTH,

Oliver

[viorel.spinu]

Finaly ... I understand

Thank U all! U did open my mind!

I love this forum!