Solved: Does my router support CBAC?

r-lemaster · ‎10-28-2003

It appears that some router IOS versions 12.2 or better support CBAC and some don't. Is there something I can look for in the SH VER or SH RUN where I can tell if the OS supports the IOS Firewall Feature Set?

scoclayton · ‎10-28-2003

OK, let's try this again. I know it can be confusing. In 12.1 images and earlier (I think), you can identify an IOS image that has the CBAC (or IOS Firewall as it sometimes referred to as) features enabled by finding an "o" in the image file name. Starting in 12.2 and later, you can identify this with an "o3" in the image file name. They both infer the same thing. The image I posted was c1600-osy56i-l.121-11.bin. Note the "o" in the image name after the platform indicator.

Now, on to the FW part. In the Software Center for the various IOS images, you will see descriptions for the various feature sets. The CBAC enabled feature sets will have FW in the description. For instance, from http://www.cisco.com/cgi-bin/Software/Iosplanner/Planner-tool/iosplanner.cgi?get_crypto=&data_from=&hardware_name=1601-1604&software_name=&release_name=12.2.19a&majorRel=12.2&state=:HW:RL&type=Limited%20Deployment you can see the following: IP/FW PLUS IPSEC 56

Note the FW above. This indicates that following this link will bring you to an image that has Firewall features enabled and also has a "o" or "o3" in the image file name.

Please do not confuse the bootstrap version of code with the version of code running on the router. You may want to go back and look at the output again. This should be 12.1(11) code for a 1600.

CBAC was added to IOS in 12.0(5)T and subsequently into 12.1 mainline as well. All version thereafter should have CBAC enabled IF an "o" or "o3" exists in the image file name.

I really hope this helps.

Scott

View solution in original post

nkhawaja · ‎10-28-2003

Hi,

Check from letter "o" in the image name.

Thanks

Nadeem

r-lemaster · ‎10-28-2003

Thanks Nadeem,

CCO says look for "FW" in the image name, but I don't see that or "O" in the image names I've used.

Image names are often changed before being installed. Is there another way to see if the Firewall set is installed?

scoclayton · ‎10-28-2003

Hi,

FW will be in the image description but is represented by an 'o' in the image name as Nadeem said. Other than this, there isn't a real good way to see this info. Can you post the 'sh ver' from your router? Perhaps we can infer some more data from this info to help?

Scott

r-lemaster · ‎10-28-2003

The problem is that this is for a lab and most images get renamed and overwritten.

Can you respond with some examples of an image description with "FW" or an image name with "O"?

scoclayton · ‎10-28-2003

OK, I understand that. I was simply saying that I may be able to infer some more info from the 'sh ver' output on your router to help but if this is the tactic you want to take, here ya go:

Router#sh ver

Cisco Internetwork Operating System Software

IOS (tm) 1600 Software (C1600-OSY56I-L), Version 12.1(11), RELEASE SOFTWARE (fc1)

Compiled Tue 02-Oct-01 20:56 by kellythw

Image text-base: 0x08053488, data-base: 0x02005000

ROM: System Bootstrap, Version 11.1(10)AA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

ROM: 1600 Software (C1600-BOOT-R), Version 11.1(10)AA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

Router uptime is 9 weeks, 10 hours, 41 minutes

System returned to ROM by reload at 10:05:27 UTC Wed Apr 9 2003

System image file is "flash:/c1600-osy56i-l.121-11.bin"

cisco 1604 (68360) processor (revision C) with 4608K/1536K bytes of memory.

Processor board ID 10203127, with hardware revision 00972006

Bridging software.

X.25 software, Version 3.0.0.

Basic Rate ISDN software, Version 1.1.

1 Ethernet/IEEE 802.3 interface(s)

1 ISDN Basic Rate interface(s)

U interface with external S bus interface for ISDN Basic Rate interface.

System/IO memory with parity disabled

2048K bytes of DRAM onboard 4096K bytes of DRAM on SIMM

System running from FLASH

7K bytes of non-volatile configuration memory.

16384K bytes of processor board PCMCIA flash (Read ONLY)

Configuration register is 0x2102

Router#

Scott

r-lemaster · ‎10-28-2003

Thanks Scott,

We have a whole bunch of routers in our lab, and even if I sent you a sh ver for each one, most of the image names have been renamed. I don't want to waste your time.

We have a lab full of 2500 and 2600 routers. Most are running IOS v.12+ but don't support the IOS firewall set. The main objective is to be able to identify whether any router supports CBAC (this is for a written lab exercise), not whether one router supports CBAC.

Does this router support the IOS Firewall Set? It is my understanding that you need IOS v 12.2 or better. This shows an IOS v 11.1.

If this router does support the IOS firewall set, could you please specifically identify the part of this sh ver that says that?

In the written lab, I tell the reader that they must have a router with IOS v12.2 or better with the Firewall Set. HERE'S HOW TO SEE IF YOUR ROUTER SUPPORTS CBAC_____________________________.

If you tell me how to fill in the blank, I won't bother you anymore. For example, look for "O" in the image name, for example ______ or look for "FW" in the description field, for example ________.

Thanks again.

r-lemaster · ‎10-28-2003

I'm finding conflicting info on the cisco site (or I'm misunderstanding). At this link:

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800949e4.shtml

CCO says that "o3" in the image name means it includes CBAC, and then it says that "FW" in the image name means that it supports CBAC.

Could you please help with some examples to clarify the issue? The sh ver from the 1600 you posted doesn't appear to be a IOS image that supports CBAC.

Thanks for your time.

scoclayton · ‎10-28-2003

OK, let's try this again. I know it can be confusing. In 12.1 images and earlier (I think), you can identify an IOS image that has the CBAC (or IOS Firewall as it sometimes referred to as) features enabled by finding an "o" in the image file name. Starting in 12.2 and later, you can identify this with an "o3" in the image file name. They both infer the same thing. The image I posted was c1600-osy56i-l.121-11.bin. Note the "o" in the image name after the platform indicator.

Now, on to the FW part. In the Software Center for the various IOS images, you will see descriptions for the various feature sets. The CBAC enabled feature sets will have FW in the description. For instance, from http://www.cisco.com/cgi-bin/Software/Iosplanner/Planner-tool/iosplanner.cgi?get_crypto=&data_from=&hardware_name=1601-1604&software_name=&release_name=12.2.19a&majorRel=12.2&state=:HW:RL&type=Limited%20Deployment you can see the following: IP/FW PLUS IPSEC 56

Note the FW above. This indicates that following this link will bring you to an image that has Firewall features enabled and also has a "o" or "o3" in the image file name.

Please do not confuse the bootstrap version of code with the version of code running on the router. You may want to go back and look at the output again. This should be 12.1(11) code for a 1600.

CBAC was added to IOS in 12.0(5)T and subsequently into 12.1 mainline as well. All version thereafter should have CBAC enabled IF an "o" or "o3" exists in the image file name.

I really hope this helps.

Scott

gfullage · ‎10-28-2003

If the image filename has been renamed, then the easiest thing to do is simply see if the router supports the "ip inspect" command. Do the following:

conf t

ip inspect ?

If you get an error then it doesn't have a FW IOS version loaded.