642-825 Implementing Secure Converged Wide Area Networks Exam Review

Demo Question 20.

Answer: B

Explanation: SDM, a configuration and management tool for Cisco IOS routers using a GUI, offers a simple method to set up the Cisco IOS Firewall. Depending on the number of router interfaces, you will select either the Basic Firewall Configuration wizard, which supports only one outside interface and one or more inside interfaces, or the Advanced Firewall Configuration wizard, which, in addition to the inside and outside interfaces, also supports a DMZ interface. When the firewall features are configured on the router, the wizard finishes and you are placed in the Edit Firewall Policy / ACL tab of the Firewall and ACL menu. In this window, you can review and modify the configured options. The figure illustrates how to view the ACL entries applied for the originating traffic (ACL 100 in this example); in other words, you examine the ACL that is applied to the inside interface in inbound direction. Example: ACL 100 is applied inbound to the inside interface. It prevents spoofing by denying packets sourced from 200.0.0.0/30 network, which is configured on the outside interface. The ACL also blocks packets sourced from the broadcast address and the 127.0.0.0/8 network and permits all other traffic. The inspection rule name in this example is SDM_LOW In this example, the firewall is active from the Fa0/0 to S0/0/0 direction, where Fa0/0 is in the inside (trusted) interface and S0/0/0 is the outside (untrusted) interface. You can also verify that the firewall is active by the firewall icon displayed inside the router icon.