Context-based access control (CBAC) is a feature of firewall software which intelligently filters TCP and UDP packets based on application layer protocol session information. It can be used for intranets, extranets and internets.
CBAC can be configured to permit specified TCP and UDP traffic through a firewall only when the connection is initiated from within the network needing protection. (In other words, CBAC can inspect traffic for sessions that originate from the external network.) However, while this example discusses inspecting traffic for sessions that originate from the external network, CBAC can inspect traffic for sessions that originate from either side of the firewall. This is the basic function of a stateful inspection firewall.
Without CBAC, traffic filtering is limited to access list implementations that examine packets at the network layer, or at most, the transport layer. However, CBAC examines not only network layer and transport layer information but also examines the application-layer protocol information (such as FTP connection information) to learn about the state of the TCP or UDP session. This allows support of protocols that involve multiple channels created as a result of negotiations in the FTP control channel. Most of the multimedia protocols as well as some other protocols (such as FTP, RPC, and SQL*Net) involve multiple control channels.
CBAC inspects traffic that travels through the firewall to discover and manage state information for TCP and UDP sessions. This state information is used to create temporary openings in the firewall's access lists to allow return traffic and additional data connections for permissible sessions (sessions that originated from within the protected internal network).
CBAC does the deep packet inspection and hence it is termed to be a IOS Firewall.
CBAC also provides the following benefits:
- Denial-of-Service prevention and detection
- Real-time alerts and audit trails
Famous quotes containing the words access and/or control:
“The nature of women’s oppression is unique: women are oppressed as women, regardless of class or race; some women have access to significant wealth, but that wealth does not signify power; women are to be found everywhere, but own or control no appreciable territory; women live with those who oppress them, sleep with them, have their children—we are tangled, hopelessly it seems, in the gut of the machinery and way of life which is ruinous to us.”
—Andrea Dworkin (b. 1946)
“If the technology cannot shoulder the entire burden of strategic change, it nevertheless can set into motion a series of dynamics that present an important challenge to imperative control and the industrial division of labor. The more blurred the distinction between what workers know and what managers know, the more fragile and pointless any traditional relationships of domination and subordination between them will become.”
—Shoshana Zuboff (b. 1951)