Table of Contents
Advertisement
System Components
ACLs and VACLs
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
A-22
We recommend that you disable NAC from blocking when you are
Note
configuring any network device, including the PIX Firewall.
•
Up to 250 active blocks at any given time
NAC can maintain up to 250 active blocks at a time. Although NAC can
support up to 65535 blocks, we recommend that you configure no more than
250 at a time.
The number of blocks is not the same as the number of
Note
interface/directions.
If you want to filter packets on an interface/direction that NAC controls, you can
configure NAC to apply an ACL before any blocks (preblock ACL) and to apply
an ACL after any blocks (postblock ACL). These ACLs are configured on the
network device as inactive ACLs. You can define preblock and postblock ACLs
for each interface and direction. NAC retrieves and caches the lists and merges
them with the blocking Access Control Entries (ACE) whenever it updates the
active ACL on the network device. In most cases, you will want to specify a
preexisting ACL as the postblock ACL so that it does not prevent any blocks from
taking effect. ACLs work by matching a packet to the first ACE entry found. If
this first ACE entry permits the packet, a subsequent deny statement will not be
found.
You can specify different preblock and postblock ACLs for each
interface/direction, or you can reuse the same ACLs for multiple
interface/directions. If you do not want to maintain a preblock list, you can use
the never block option and always block hosts and networks by using existing
configuration statements. A forever block is a normal block with a timeout value
of -1.
NAC only modifies ACLs that it owns. NAC does not modify ACLs that you have
defined. The ACLs maintained by NAC have a specific format that should not be
used by user-defined ACLs. The naming convention is
IDS_<ifname>_[in|out]_[0|1]. <ifname> corresponds to the name of the
blocking interface as given in the NAC configuration.
Appendix A
Intrusion Detection System Architecture
78-15597-02
Advertisement
Table of Contents
Troubleshooting
