Chapter 12 - Filtering, Intrusion Detection, and Attack Management

Abstract

The Cisco PIX firewall is an advanced product and has many different options for protecting against network layer attacks. It also supports content filtering for outbound Web and FTP access and a limited form of intrusion detection. The PIX firewall can filter and block potentially harmful Web traffic, including Java and ActiveX applications. This chapter discusses how the PIX firewall can integrate with virus-filtering, spam-blocking, and adware mechanisms. The PIX firewall provides integrated intrusion detection for common information-gathering stacks and network attacks. How to use IDS signatures in the PIX firewall to detect common network attacks is discussed in this chapter. Content filtering features on the PIX can be used to enforce a company's acceptable use policy. Finally, the PIX has embedded protection against various DoS attacks, such as SYN floods, excessive fragmentation, and excessive connection establishment. The reverse-path forwarding feature supports IP address antispoofing.