There seems be a lot of people interested in CCNA Security so let’s have a brief look at Zone Based Firewalls.

Here is today’s topology,  we’ll be trying to lock down the server to server communication from R10.

A Zone based firewall is Cisco’s attempt at bringing the ASA’s inspection logic to a IOS device and is much more modular than a traditional ACL.

First things first we will create zones, these are basically the same thing as a ASA nameif.

 R10(config)#zone security R01
 R10(config-sec-zone)#description R01 Zone
 R10(config-sec-zone)#exit
 R10(config)#zone security R02 
 R10(config-sec-zone)#description R02 Zone
 R10(config-sec-zone)#exit

Next we make class-maps to match traffic, you can use match protocol to use NBAR or you can create a ACL and match that instead. We’ll match ICMP and HTTP traffic with NBAR and use an ACL for telnet.

R10(config)#ip access-list extended ACL_TELNET
 R10(config-ext-nacl)# permit tcp any any eq telnet
 R10(config-ext-nacl)# permit tcp any eq telnet any

R10(config)#class-map type inspect match-all CM_TELNET
 R10(config-cmap)# match access-group name ACL_TELNET
 
 R10(config)#class-map type inspect match-all CM_ICMP
 R10(config-cmap)# match protocol icmp 
 R10(config-cmap)#exit
 R10(config)#class-map type inspect match-all CM_HTTP
 R10(config-cmap)# match protocol http 
 R10(config-cmap)#exit

Next we make a policy-map to match all the class-maps, we can inspect traffic traffic, bypass the firewall by using pass, or drop the traffic. We will allow ICMP and HTTP and explicitly drop telnet. We will also use drop log in the class-default so that all unmatched traffic is logged when it is dropped. The policy-map is processed top down just like a ACL so you may need to change the class-map order in more complex setups.

  R10(config)#policy-map type inspect PM_R01_TO_R02
 R10(config-pmap)# class type inspect CM_HTTP
 R10(config-pmap-c)# inspect
 R10(config-pmap-c)# class type inspect CM_ICMP
 R10(config-pmap-c)# inspect
 R10(config-pmap-c)# class type inspect CM_TELNET
 R10(config-pmap-c)# drop log
 R10(config-pmap-c)# class class-default
 R10(config-pmap-c)# drop log

Once that is done we now need to bind the zones together and apply the policy-map, we will apply the firewall so R01 is the source zone and R02 is the destination zone. This means that R01 will be able to talk to R02 but R02 won’t be able to talk to R01 unless its return traffic.

 R10(config)#zone-pair security ZP_R01_TO_R02 source R01 destination R02
 R10(config-sec-zone-pair)# service-policy type inspect PM_R01_TO_R02
 R10(config-sec-zone-pair)#exit

Lastly we need to add the interfaces to their proper zones.

 R10(config)#interface GigabitEthernet2.110
 R10(config-subif)# zone-member security R01
 R10(config-subif)#interface GigabitEthernet2.210
 R10(config-subif)# zone-member security R02
 R10(config-subif)#exit

On S01 we can access HTTP to the S02

 cisco@S01:~$ curl 192.168.20.100 | tail -n 5
 % Total % Received % Xferd Average Speed Time Time Time Current
 Dload Upload Total Spent Left Speed
 100 11510 100 11510 0 0 15010 0 --:--:-- --:--:-- --:--:-- 15045
 </p>
 </div>
 </body>
 </html>

And we can ping server S02 as well.

 cisco@S01:~$ ping 192.168.20.100 -c 5
 PING 192.168.20.100 (192.168.20.100) 56(84) bytes of data.
 64 bytes from 192.168.20.100: icmp_seq=1 ttl=61 time=220 ms
 64 bytes from 192.168.20.100: icmp_seq=2 ttl=61 time=322 ms
 64 bytes from 192.168.20.100: icmp_seq=3 ttl=61 time=250 ms
 64 bytes from 192.168.20.100: icmp_seq=4 ttl=61 time=203 ms
 64 bytes from 192.168.20.100: icmp_seq=5 ttl=61 time=416 ms
 
 --- 192.168.20.100 ping statistics ---
 5 packets transmitted, 5 received, 0% packet loss, time 4010ms
 rtt min/avg/max/mdev = 203.221/282.655/416.633/78.396 ms
 cisco@S01:~$ 

But if we try to ssh to the server it will be blocked.

 cisco@S01:~$ ssh 192.168.20.100
 
 *Jun 3 20:37:51.184: %IOSXE-6-PLATFORM: F0: cpp_cp: QFP:0.0 Thread:000 TS:00000004246156627399 %FW-6-DROP_PKT: Dropping tcp pkt from GigabitEthernet2.110 192.168.10.100:41755 => 192.168.20.100:22(target:class)-(ZP_R01_TO_R02:class-default) due to Policy drop:classify result with ip ident 24557 tcp flag 0x2, seq 3211098309, ack 0

From S02 we can’t access S01’s http server because we never permitted the direction.

 cisco@S02:~$ curl 192.168.10.100
 curl: (7) Failed to connect to 192.168.10.100 port 80: Connection timed out

We can also see various firewall statistics on the router.

 R10#show policy-map type inspect zone-pair ZP_R01_TO_R02 
 Zone-pair: ZP_R01_TO_R02 
 Service-policy inspect : PM_R01_TO_R02

Class-map: CM_HTTP (match-all) 
 Match: protocol http
 Inspect
 Packet inspection statistics [process switch:fast switch]
 http packets: [0:177]

Session creations since subsystem startup or last reset 7
 Current session counts (estab/half-open/terminating) [0:0:0]
 Maxever session counts (estab/half-open/terminating) [0:0:0]
 Last session created 00:42:18
 Last statistic reset never
 Last session creation rate 0
 Last half-open session total 0

Class-map: CM_ICMP (match-all) 
 Match: protocol icmp
 Inspect
 Packet inspection statistics [process switch:fast switch]
 icmp packets: [0:14]

Session creations since subsystem startup or last reset 2
 Current session counts (estab/half-open/terminating) [0:0:0]
 Maxever session counts (estab/half-open/terminating) [1:0:0]
 Last session created 00:41:55
 Last statistic reset never
 Last session creation rate 0
 Last half-open session total 0

Class-map: CM_TELNET (match-all) 
 Match: access-group name ACL_TELNET
 Drop
 2 packets, 156 bytes

Class-map: class-default (match-any) 
 Match: any 
 Drop
 17 packets, 1446 bytes