Today we are going to do a step by step configuration of Zone-Based Policy Firewall (ZPF). First we will discuss about ZPF and then dive into the configuration. A good place to start is by going to Cisco.
This is what Cisco says about Zone-Base Policy firewall.
Zone-Based Policy Firewall (also known as Zone-Policy Firewall, or ZFW)
changes the firewall configuration from the older interface-based model to a
more flexible, more easily understood zone-based model. Interfaces are assigned
to zones, and inspection policy is applied to traffic moving between the zones.
Inter-zone policies offer considerable flexibility and granularity, so
different inspection policies can be applied to multiple host groups connected
to the same router interface.
Firewall policies are configured with the Cisco® Policy Language (CPL),
which employs a hierarchical structure to define inspection for network
protocols and the groups of hosts to which the inspection will be applied.
Rules For Applying Zone-Based Policy Firewall
Router network interfaces’ membership in zones is subject to several
rules that govern interface behaviour, as is the traffic moving between zone
member interfaces:
-
- A zone must be configured before interfaces can be assigned to the zone.
-
An interface can be assigned to only one security
zone.
-
All traffic to and from a given interface is implicitly blocked when
the interface is assigned to a zone, except traffic to and from other
interfaces in the same zone, and traffic to any interface on the
router.
-
Traffic is implicitly allowed to flow by default among interfaces
that are members of the same zone.
-
In order to permit traffic to and from a zone member interface, a
policy allowing or inspecting traffic must be configured between that zone and
any other zone.
-
The self zone is the only exception to the default deny all policy.
All traffic to any router interface is allowed until traffic is explicitly
denied.
-
Traffic cannot flow between a zone member interface and any interface
that is not a zone member. Pass, inspect, and drop actions can only be applied
between two zones.
-
Interfaces that have not been assigned to a zone function as
classical router ports and might still use classical stateful inspection/CBAC
configuration.
First let us do the basic configuration to establish connectivity within AS 100. Here is the basic configuration.
IOU1
====conf t
hostname IOU1
int eth0/0
ip add 192.168.14.1 255.255.255.0
no shut
exit
int eth0/2
ip add 192.168.12.1 255.255.255.0
no shut
exit
int eth0/3
ip add 192.168.13.1 255.255.255.0
no shut
exit
int loopback0
ip add 1.1.1.1 255.255.255.255
exi
router eigrp CCIE
address-family ipv4 autonomous-system 100
network 0.0.0.0 255.255.255.255
=======================================================
IOU2
====
conf t
hostname IOU2
int eth0/2
ip add 192.168.12.2 255.255.255.0
no shut
exit
int loopback0
ip add 2.2.2.2 255.255.255.255
exit
router eigrp CCIE
address-family ipv4 autonomous-system 100
network 0.0.0.0 255.255.255.255
=======================================================
IOU3
====
conf t
hostname IOU3
int eth0/3
ip add 192.168.13.3 255.255.255.0
no shut
exit
int loopback0
ip add 3.3.3.3 255.255.255.255
exit
router eigrp CCIE
address-family ipv4 autonomous-system 100
network 0.0.0.0 255.255.255.255
=======================================================
IOU4
====
conf t
hostname IOU4
int eth0/0
ip add 192.168.14.4 255.255.255.0
no shut
exit
int loopback0
ip add 4.4.4.4 255.255.255.255
exit
router eigrp CCIE
address-family ipv4 autonomous-system 100
network 0.0.0.0 255.255.255.255
=======================================================
Lets verify connectivity. It was verified that all the devices can ping each others loopbacks.
The security policy requirement in AS 100 is as follows:
1. R1 is to be managed from the Outside network with only Telnet and SSH. It is not a good idea to use Telnet from outside to manage a network. This is just an example to show how ZPF works. It is also required that R1 should accept Ping from the Outside network as well. You will realise that all this traffic is destined to the router itself which will require the use of the Zelf Zone. The Zelf Zone is meant for traffic destine to the router itself, while the user defined Zones are meant for traffic traversing the router.
2. The inside user simulated as R2's loopback (2.2.2.2) is allowed everything.
3. The outside user simulated by R3's loopack(3.3.3.3) is allowed to to access the DMZ web server (4.4.4.4) and also to be able to ping the DMZ to test connectivity.
Solution:
These are the basic steps in creating a ZPF:
–
zone security “zone security name”
22. Assign Router Interfaces to
zones.
–
zone-member security “zone security name”
33. Create zone-pairs
zone-pair security “zone pair name” source
“source security name” destination “destination zone security name”
44. Define Traffic Classes.
- class-map type inspect “class map name”
55. Specify Firewall Policies.
- policy-map type inspect “policy map name”
66. Apply Firewall Policies to
pairs of source and destination zones.
- Zone-pair security “zone pair name” source
“source zone security name” destination “destination zone security name”
service-policy type inspect “Policy map name”
1. First we create the zones:
2. Assign zones to interfaces:
Let us verify rule number 3 which states:
All traffic to and from a given interface is implicitly blocked when
the interface is assigned to a zone, except traffic to and from other
interfaces in the same zone, and traffic to any interface on the
router.
This results shows that the only traffic that was accepted was the one destined to the router itself R1's loopback0.
3. Create zone-pairs
The zone created are:
Please note that the self zone is created by default. You do not create it.
4. Define traffic class.Let us do the first requirement and then do the others.
Now we can test from the IOU3 to see if the requirements are met. We will telnet to R1. To test that hhttp (port80) is not allowed, we will telnet with a port of 80 as well.
Let us now do requirement two. To allow the internal users access to everything.
We will continue from step 4.
4. Define the class maps
Now we can test from IOU2 to see if the requirements are met.
now lets do requirement 3:
The outside user simulated by IOU3's loopack(3.3.3.3) is allowed to access the DMZ web server (4.4.4.4) and also to be able to ping the DMZ to test connectivity.
At the moment the outside user cannot do any of the above requirements.
4. Define the class maps
6. Apply firewall policies to zone pairs on IOU1.
It seems we have a little bit of a challenge here. The pings are not going since we are in a learning process, it give us an opportunity to sharpen our troubleshooting skills.
Le us issue the show class-map type inspect at IOU1 to view our class-map.
