CBAC Configuration

As you learned earlier in this chapter, authentication proxy does not create ACEs to support returning data traffic or data channel traffic. So, it’s necessary either to create static ACLs to allow the return traffic or to configure the CBAC inspection rules in the firewall configuration. Because static ACLs increase the network vulnerability (they’re permanent “holes” in the firewall) and the CBAC “hole” only exists as long as needed, the solution is quite simple.