ccna 3 chapter 6 pdf

ccna 3 chapter 6 pdf.operand ] destination-addr [ destination-wildcard ] [ operator operand ] [established]The established keyword forces the router to check whether the TCPACK or RST control token is set. If the ACK token is set, TCP traffic is allowed; if not, the traffic is assumed to be associated with a new connection originating from outside.Stateful firewalling cannot be implemented on a router using the established keyword. Because status information cannot be saved, traffic originating from the internal network cannot be tracked either The oestablished parameter allows TCP segments for which the control tag is properly set. The router does not track session information and therefore cannot determine if the traffic is return traffic associated with an internally originated connection.Therefore, using the established keyword to allow return traffic into the network is equivalent to opening a hole in the router.90 Chapter 4 Implementing Firewall TechniquesA hacker can exploit this vulnerability by using a packet generator or scanner, such as Nmap, to sneak into the network by passing off TCP packets as return traffic. A hacker can do this by using a packet generator to set a bit(s) in the TCP control field. The established option cannot be applied to UDP or ICMP traffic, because UDP and ICMP traffic do not depend on any of the control flags used in TCP traffic.4.1.4.3 TCP established operationDespite the vulnerability of established, it provides a more secure solution due to the fact that a match can only occur when the ACK or RST control bit of a TCP packet is set.R1(config)# access-list 100 permit tcp any eq 443 192.168.1.0 0.0.0.255 estabaccess-list 100 lished permittcpany192.168.1.30.0.0.0.0eq22access- list100denyipanyanyinterface R1(config)# S0/0/0 R1(config)# R1(config-if)# ipaccess-group100inR1(config)# Any TCP traffic with a source port of 443 is allowed if the established keyword is not included. With this keyword, only traffic from source port 443,with the YACK, FIN, PSH, RST, SYN, or URGTCP control flags set, is allowed.