文档介绍：Application Note
Cisco Router and Security Device Manager Firewall Policy
Management
Introduction
Security administrators can easily and quickly manage access control lists (ACLs) and packet-inspection rules through a graphical and intuitive
Firewall Wizard and Firewall Policy table available with Cisco® Router and Security Device Manager (SDM).
Cisco IOS Firewall
Cisco IOS® Firewall applies access lists and inspection rules to a traffic flow at inbound or outbound router interfaces.
Deployment Scenario
Figure 1 shows the deployment of a branch-office firewall without the Cisco SDM Firewall Wizard and Firewall Policy support. The
Cisco IOS Firewall resides in a branch office, with the outside (0) interface connected to the work via the , and the
inside (Fast 0/0) interface connected to the branch-office .
Figure 1 Branch Office Firewall Deployment Scenario
The deployment involves two steps: basic firewall configuration and branch office-specific configuration.
Branch Office Firewall Sample Configuration
Basic Firewall Configuration
The basic firewall configuration is generic to all Cisco IOS firewalls. The Cisco IOS Firewall is configured to protect the branch office by
denying local loopback traffic and broadcast traffic, and by denying spoofing packets on both inside and outside interfaces. The inspection rules
are applied to the outbound packets of the outside interface.
The following are the Cisco IOS mands necessary to configure a basic firewall for this deployment scenario.
!
© 2004 Cisco System s, Inc. All right re se rv e d .
Important notices, privacy statem ents, and tradem arks of Cisco System s, Inc. can be found on
Page 1 of 19
! acl 101 for outside interface
! turn on unicast reverse path forwarding check
! permit IPSec tunnel traffic
! permit GRE tunnel traffic
! deny spoofing traffic
! deny broadcast, local loopback and private address
!
access-list 101 deny ip .