Hacking Cisco: Lab 222 - Zone-Based Firewall Part 1

Prerequisites: CCNP level skills.

Topology

Pic 1. Topology Diagram.

Task 1
Consider R1 as the edge router. It's interface Fa0/0 is the OUTSIDE and Se0/0 is the INSIDE interface. Configure firewall on R1 using the following rules:

Allow all traffic from INSIDE to OUTSIDE
Allow only SSH traffic from OUTSIDE to R1's address 192.0.2.1
Allow BGP protocol between R1 and BB3 (to be implemented) and log all other dropped traffic

Use zone-based firewall syntax to accomplish the goal.

Solution

Task 1
Consider R1 as the edge router. It's interface Fa0/0 is the OUTSIDE and Se0/0 is the INSIDE interface. Configure firewall on R1 using the following rules:

Allow all traffic from INSIDE to OUTSIDE
Allow only SSH traffic from OUTSIDE to R1's address 192.0.2.1
Allow BGP protocol between R1 and BB3 (to be implemented) and log all other dropped traffic

Use zone-based firewall syntax to accomplish the goal.

R1 Config:

! Current routing configuration on R1:
!
ip route 0.0.0.0 0.0.0.0 192.0.2.254
!
router eigrp 1
redistribute static metric 1 1 1 1 1
network 10.0.1.1 0.0.0.0
network 172.16.123.1 0.0.0.0
network 172.16.215.1 0.0.0.0
no auto-summary
!
!
! Current routing on BB3:
!
ip route 0.0.0.0 0.0.0.0 192.0.2.1
!

Zone-base firewall configuration on R1:

Step 1
Define the zones.

!
zone security INSIDE
zone security OUTSIDE
!

Step 2
Classify interesting traffic (traffic that is allowed from INSIDE to OUTSIDE).
Classify the traffic exceptions.

!
class-map type inspect match-all ICMP
match protocol icmp
class-map type inspect match-all UDP
match protocol udp
class-map type inspect match-all TCP
match protocol tcp
!
! Traffic Exceptions
!
ip access-list extended SSH_TO_R1
permit tcp any host 192.0.2.1 eq 22
!
class-map type inspect match-any OUTSIDE_TO_SELF_EXCEPTIONS
match protocol bgp
match access-group name SSH_TO_R1
!

Step 3
Configure policy regarding the interesting traffic.

!
policy-map type inspect INSIDE_TO_OUTSIDE_POLICY
class type inspect TCP
inspect
class type inspect UDP
inspect
class type inspect ICMP
inspect
!
!
policy-map type inspect OUTSIDE_TO_SELF_POLICY
class type inspect OUTSIDE_TO_SELF_EXCEPTIONS
pass
class class-default
drop log
!

Step 4
Configure associations between zones. Apply policy map to the zone pairings.

!
zone-pair security INSIDE_TO_OUTSIDE_PAIRING source INSIDE destination OUTSIDE
service-policy type inspect INSIDE_TO_OUTSIDE_POLICY
!
!
zone-pair security OUTSIDE_TO_SELF_PAIRING source OUTSIDE destination self
service-policy type inspect OUTSIDE_TO_SELF_POLICY
!

Step 5
Assign interfaces to the zones.

!
interface FastEthernet0/0
description OUTSIDE
ip address 192.0.2.1 255.255.255.0
zone-member security OUTSIDE
speed 100
full-duplex
!
!
interface Serial0/0
description INSIDE
ip address 172.16.123.1 255.255.255.0
zone-member security INSIDE
encapsulation frame-relay
clock rate 2000000
frame-relay map ip 172.16.123.2 102 broadcast
no frame-relay inverse-arp
!

Verification:

Pic. 2 Traffic INSIDE_TO_OUTSIDE.