Table of Contents

Product Overview
Key Features and Benefits
Context-based access control
New IOS Firewall Features in Cisco IOS 12.0(5)T
Specifications

Cisco IOS Firewall Feature Set Packaging

Ordering Information

Cisco IOS Firewall Ordering Information

Cisco IOS Firewall Feature Set

Product Overview

The Cisco IOS Firewall feature set is a security-specific option for Cisco IOS software. It integrates robust firewall functionality and intrusion detection for every perimeter of the network and enriches existing Cisco IOS security capabilities. It adds greater depth and flexibility to existing Cisco IOS security solutions such as authentication, encryption, and failover by including state-of-the-art security features such as stateful, application-based filtering, dynamic per-user authentication and authorization, defense against network attacks, Java blocking, and real-time alerts. When combined with Cisco IOS IPSec software and other Cisco IOS software-based technologies like L2TP tunneling and Quality of Service (QoS), the Cisco IOS Firewall provides a complete, integrated virtual private network (VPN) solution.

Router-Based Firewall Functionality - Available on a wide range of Cisco IOS-based routers, the Cisco IOS Firewall offers sophisticated security and policy enforcement for connections within an organization (intranet) and between partner networks (extranets), as well as for securing Internet connectivity for remote and branch offices.

The Cisco IOS Firewall is the best choice for integrating multiprotocol routing with security policy enforcement and enabling managers to configure a Cisco router as a firewall.

The Cisco IOS Firewall scales to allow customers to choose a router platform based on bandwidth, LAN and WAN density, and multiservice requirements, while benefiting from advanced security. A general guideline for choosing the right Cisco router for varied security environments.

• Small/home offices-Cisco 800, UBR904, 1600, 1720 series routers

• Branch and extranet environments-Cisco 2500, 2600, 3600 series routers

• VPN and WAN-aggregation points or other high throughput environments-Cisco 7100 and 7200 series routers

Key Features and Benefits

The Cisco IOS Firewall feature set interoperates seamlessly with Cisco IOS software, providing great value for the many benefits it delivers. The most outstanding benefits include:

• Flexibility-Installed on a Cisco router, this all-in-one scalable solution performs multiprotocol routing, perimeter security, intrusion detection, VPN functionality, and per-user authentication and authorization.

• Investment protection-Integrating firewall functionality into a multiprotocol router leverages an existing router investment without the cost and learning curve associated with a new platform.

• VPN support-Deploying Cisco IOS Firewall with Cisco IOS encryption and QoS VPN features enables extremely secure, low-cost transmissions over public networks and ensures mission-critical application traffic receives high priority delivery.

• Scalable deployment-Available for a wide variety of router platforms, the Cisco IOS Firewall scales to meet any network"s bandwidth and performance requirements.

• Easier management-With Cisco ConfigMaker software, a network administrator can configure Cisco IOS security features (including the Cisco IOS Firewall, Network Address Translation, and Cisco IPSec) from a central console over the network.

The recent addition of the Cisco IOS Firewall feature set on the Cisco 1720, 2600, 3600, 7100, and 7200 series routers has brought some important new benefits including multiservice integration (data/voice/video/dial), advanced security for dialup connections, and integrated routing and security at the Internet gateway for large enterprises and service provider customer premise equipment (CPE) on the 7200 series.

Context-based access control

The Cisco IOS Firewall CBAC engine provides secure, per-application access control across network perimeters. CBAC enhances security for TCP and user datagram protocol (UDP)applications that use well-known ports (such as file transfer protocol (FTP) and email traffic) by scrutinizing source and destination addresses. CBAC allows network administrators to implement firewall intelligence as part of an integrated, single-box solution. For example, sessions with an extranet partner involving Internet applications, multimedia applications, or Oracle databases would no longer necessitate opening a network doorway accessible via weaknesses in the partner"s network. CBAC lets tightly-secured networks run today"s basic application traffic plus advanced applications such as multimedia and videoconferencing securely through a router.

CBAC is a per-application control mechanism for IP traffic including standard TCP and UDP Internet applications, multimedia applications (including H.323 and other video applications), and Oracle databases. Before CBAC, administrators could permit advanced application traffic only by writing permanent ACLs that essentially left firewall doors open, so most administrators opted to deny all such application traffic. Now with CBAC, they can securely permit multimedia and other application traffic by opening the firewall as needed, and closing it all other times. For example, if CBAC is configured to allow Microsoft NetMeeting, when an internal user initiates a connection, the firewall permits return traffic. However, if an external NetMeeting source initiates a connection with an internal user, CBAC denies entry and drops the packets.

New IOS Firewall Features in Cisco IOS 12.0(5)T

• Intrusion detection-intrusion detection capability in the critical packet path provides dynamic monitoring, interception, and reporting of network attacks and misuse

• Authentication proxy - LAN-based, dynamic, per-user authentication and authorization via TACACS+ and RADIUS authentication servers enables setting individual security policies

• Dynamic port mapping - allows CBAC-supported applications to run on non-standard ports

• Configurable audit trail and alerts - The Cisco IOS Firewall alerts and audit trail are now configurable on a per-application basis. Java blocking is also configurable on a modular basis.

• Improved attack detection and defense for e-mail servers - new intrusion detection specifically for SMTP-oriented attacks.

Specifications

Cisco IOS Firewall Feature Set Packaging

The Cisco IOS Firewall feature set has been available in Cisco IOS as of release 11.2(11)P. The table below shows the platforms on which the Cisco IOS Firewall feature set has been released.