IOS CBAC

[hussamchawa]

Can CBAC works on a router that has behind it a firewall running PAT. Or maybe CBAC is not necessary since we have a firewall in place.

[s-doyle]

I think it’s probably overkill and likely to create more problems than what it’s worth. Check the integrity of your existing solution. If it meets your security policy and you’re happy with its performance and reliability, stick with that. If not, you might want to consider replacing it with the IOS Firewall feature set.

[mtashiro]

This does work, however, keep in mind the load you can put on your router. We have seen performance issues using a 2620 and CBAC. You may want to consider using a 2650 if you do decide to use CBAC and traffic is high.

It may be better if you use an access-list on the border router and let the firewall catch everyting else.

[tgronke]

CBAC can expose a few unexpected problems. In one case a badly-behaved NT workstation spewed DNS lookups and exceeded the threshhold set for maximum sessions per minute, effectively shutting down the interface. In another case we found old NCD X-terminals using TFTP to boot didn't set up their UDP port numbers correctly, and the "inspect name tftp" statement prevented their TFTP requests from reaching a server.