4.4.1.2 Lab – Configuring Zone-Based Policy Firewalls (Instructor Version)

Lab – Configuring Zone-Based Policy Firewalls (Instructor Version)

Instructor Note: Red font color or Gray highlights indicate text that appears in the instructor copy only.

Topology

Note: ISR G1 devices have Fast Ethernet interfaces instead of Gigabit Ethernet Interfaces.
NETLAB+ Note: PC-B is actually connected to port F0/18 on Switch 2. Switch 2 and S3 are connected using F0/3 and F0/1, respectively. All interfaces on Switch 2 should be Administratvily disabled except F0/1 and F0/18.

IP Addressing Table

Objectives

Part 1: Basic Router Configuration

• Configure host names, interface IP addresses, and access passwords.
• Configure the static routes to enable end-to-end connectivity.

Part 2: Configuring a Zone-Based Policy Firewall (ZPF)

• Use the CLI to configure a Zone-Based Policy Firewall.
• Use the CLI to verify the configuration.

Background

The most basic form of a Cisco IOS firewall uses access control lists (ACLs) to filter IP traffic and monitor established traffic patterns. A traditional Cisco IOS firewall is an ACL-based firewall.
The newer Cisco IOS Firewall implementation uses a zone-based approach that operates as a function of interfaces instead of access control lists. A Zone-Based Policy Firewall (ZPF) allows different inspection policies to be applied to multiple host groups connected to the same router interface. It can be configured for extremely advanced, protocol specific, granular control. It prohibits traffic via a default deny-all policy between different firewall zones. ZPF is suited for multiple interfaces that have similar or varying security requirements.
In this lab, you build a multi-router network, configure the routers and PC hosts, and configure a Zone-Based Policy Firewall using the Cisco IOS command line interface (CLI).
Note: The router commands and output in this lab are from a Cisco 1941 with Cisco IOS Release 15.4(3)M2
(UniversalK9-M). Other routers and Cisco IOS versions can be used. See the Router Interface Summary
Table at the end of the lab to determine which interface identifiers to use based on the equipment in the lab. Depending on the router model and Cisco IOS version, the commands available and output produced might vary from what is shown in this lab.
Note: Make sure that the routers and switches have been erased and have no startup configurations.

Required Resources

• 3 Routers (Cisco 1941 with Cisco IOS Release 15.4(3)M2 image or comparable)
• 2 Switches (Cisco 2960 or comparable)
• 3 PCs (Windows Vista or Windows 7)
• Serial and Ethernet cables, as shown in the topology
• Console cables to configure Cisco networking devices
Instructor Notes: This lab is divided into three parts. Each part can be administered individually or in combination with others as time permits. The main objective of this lab is to configure a ZPF firewall on a router.
R1 and R3 are on separate networks and communicate through R2, which simulates an ISP.
Students can work in teams of two for router configuration, one person configuring R1 and the other configuring R3.
Although switches are shown in the topology, students can omit the switches and use crossover cables between the PCs and routers R1 and R3.
The basic running configurations for all three routers are captured after Part 1 of the lab is completed. The running configuration commands that are added to R3 in Part 2 are captured and listed separately. All configurations are found at the end of the lab.

Part 1: Basic Router Configuration

In Part 1 of this lab, you set up the network topology and configure basic settings, such as the interface IP addresses, static routing, device access, and passwords.
Note: All tasks should be performed on routers R1, R2, and R3. The procedures are shown for only one of the routers.

Step 1: Cable the network as shown in the topology.

Attach the devices as shown in the topology diagram, and cable as necessary.

Step 2: Configure basic settings for each router.

a. Configure host names as shown in the topology.
b. Configure the interface IP addresses as shown in the IP addressing table.
c. Configure a clock rate for the serial router interfaces with a DCE serial cable attached.

R2(config)# interface S0/0/0
R2(config-if)# clock rate 64000

Step 3: Disable DNS lookup.

To prevent the router from attempting to translate incorrectly entered commands, disable DNS lookup.

R2(config)# no ip domain-lookup

Step 4: Configure static routes on R1, R2, and R3.

a. In order to achieve end-to-end IP reachability, proper static routes must be configured on R1, R2 and R3. R1 and R3 are stub routers, and as such, only need a default route pointing to R2. R2, behaving as the ISP, must know how to reach R1’s and R3’s internal networks before end-to-end IP reachability is achieved. Below is the static route configuration for R1, R2 and R3. On R1, use the following command:

R1(config)# ip route 0.0.0.0 0.0.0.0 10.1.1.2

b. On R2, use the following commands.

R2(config)# ip route 192.168.1.0 255.255.255.0 10.1.1.1
R2(config)# ip route 192.168.3.0 255.255.255.0 10.2.2.1
R2(config)# ip route 192.168.33.0 255.255.255.0 10.2.2.1

c. On R3, use the following command.

R3(config)# ip route 0.0.0.0 0.0.0.0 10.2.2.2

Step 5: Configure PC host IP settings.

Configure a static IP address, subnet mask, and default gateway for PC-A, PC-B, and PC-C as shown in the IP addressing table.

Step 6: Verify basic network connectivity.

a. Ping from R1 to R3.
If the pings are not successful, troubleshoot the basic device configurations before continuing.
b. Ping from PC-A on the R1 LAN to PC-C on the R3 LAN.
If the pings are not successful, troubleshoot the basic device configurations before continuing.
Note: If you can ping from PC-A to PC-C, you have demonstrated that the end-to-end IP reachability has been achieved. If you cannot ping but the device interfaces are UP and IP addresses are correct, use theshow interface, show ip interface, and show ip route commands to help identify problems.

Step 7: Configure a user account, encrypted passwords and crypto keys for SSH.

Note: Passwords in this task are set to a minimum of 10 characters, but are relatively simple for the benefit of performing the lab. More complex passwords are recommended in a production network.

a. Configure a minimum password length using the security passwords command to set a minimum password length of 10 characters.

R1(config)# security passwords min-length 10

b. Configure a domain name.

R1(config)# ip domain-name ccnasecurity.com

c. Configure crypto keys for SSH

R1(config)# crypto key generate rsa general-keys modulus 1024

d. Configure an admin01 user account using algorithm-type scrypt for encryption and a password of cisco12345.

R1(config)# username admin01 algorithm-type scrypt secret cisco12345

e. Configure line console 0 to use the local user database for logins. For additional security, the exec-timeout command causes the line to log out after 5 minutes of inactivity. The logging synchronouscommand prevents console messages from interrupting command entry.
Note: To avoid repetitive logins during this lab, the exec-timeout command can be set to 0 0, which prevents it from expiring; however, this is not considered to be a good security practice.

R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# logging synchronous

f. Configure line aux 0 to use the local user database for logins.

R1(config)# line aux 0
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0

g. Configure line vty 0 4 to use the local user database for logins and restrict access to SSH connections only.

R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 5 0

h. Configure the enable password with strong encryption.

R1(config)# enable algorithm-type scrypt secret class12345

Step 8: Save the basic running configuration for all three routers.

Save the running configuration to the startup configuration from the privileged EXEC prompt.

R1# copy running-config startup-config

Part 2: Configuring a Zone-Based Policy Firewall (ZPF)

In Part 2 of this lab, you configure a zone-based policy firewall (ZPF) on R3 using the command line interface (CLI).

Task 1: Verify Current Router Configurations.

In this task, you will verify end-to-end network connectivity before implementing ZPF.

Step 1: Verify end-to-end network connectivity.

a. Ping from R1 to R3 Using both of R3’s Gigabit Ethernet interface IP addresses.
If the pings are not successful, troubleshoot the basic device configurations before continuing.
b. Ping from PC-A on the R1 LAN to PC-C on the R3 conference room LAN.
If the pings are not successful, troubleshoot the basic device configurations before continuing.
c. Ping from PC-A on the R1 LAN to PC-B on the R3 internal LAN.
If the pings are not successful, troubleshoot the basic device configurations before continuing.

Step 2: Display the R3 running configurations.

a. Issue the show ip interface brief command on R3 to verify the correct IP addresses were assigned. Use the IP Address Table to verify the addresses.
b. Issue the show ip route command on R3 to verify it has a static default route pointing to R2’s serial 0/0/1 interface.
c. Issue the show run command to review the current basic configuration on R3.
d. Verify the R3 basic configuration as performed in Part 1 of the lab. Are there any security commands related to access control?
____________________________________________________________________________________
There should not be.

Task 2: Create a Zone-Based Policy Firewall

In this task, you will create a zone-based policy firewall on R3, making it act not only as a router but also as afirewall. R3 is currently responsible for routing packets for the three networks connected to it. R3’s interfaceroles are configured as follows:
Serial 0/0/1 is connected to the Internet. Because this is a public network, it is considered an untrustednetwork and should have the lowest security level.
G0/1 is connected to the internal network. Only authorized users have access to this network. In addition, vital institution resources also reside in this network. The internal network is to be considered a trusted network and should have the highest security level.
G0/0 is connected to a conference room. The conference room is used to host meetings with people who are
not part of the organization.
The security policy to be enforced by R3 when it is acting as a firewall dictates that:
• No traffic initiated from the Internet should be allowed into the internal or conference room networks.
• Returning Internet traffic (return packets coming from the Internet into the R3 site, in response to requests originating from any of the R3 networks) should be allowed.
• Computers in the R3 internal network are considered trusted and are allowed to initiate any type traffic (TCP, UDP or ICMP based traffic).
• Computers in the R3 conference room network are considered untrusted and are allowed to initiate only web traffic (HTTP or HTTPS) to the Internet.
• No traffic is allowed between the internal network and the conference room network. There is no guarantee regarding the condition of guest computers in the conference room network. Such machines could be infected with malware and might attempt to send out spam or other malicious traffic.

Step 1: Creating the security zones.

A security zone is a group of interfaces with similar security properties and requirements. For example, ifa router has three interfaces connected to internal networks, all three interfaces can be placed under the same zone named “internal”. Because all security properties are configured to the zone instead of to the individual router interfaces, the firewall design is much more scalable.
In this lab, the R3 site has three interfaces; one connected to an internal trusted network, one connected to the conference room network and another connected to the Internet. Because all three networks have different security requirements and properties, we will create three different security zones.

a. Security zones are created in global configuration mode, and the command allows for zone name definition. In R3, create three zones named INSIDE, CONFROOM and INTERNET:

R3(config)# zone security INSIDE
R3(config)# zone security CONFROOM
R3(config)# zone security INTERNET

Step 2: Creating Security Policies

Before ZPF can decide if some specific traffic should be allowed or denied, it must be told what traffic is to be considered. Cisco IOS uses class-maps to select traffic. Interesting traffic is a common denomination for traffic that has been selected by a class-map.
While class-maps select traffic, it is not their job to decide what happens to the selected traffic; Policymaps decide the fate of the selected traffic.
ZPF traffic policies are defined as policy-maps and use class-maps to select traffic. In other words, classmaps define what traffic is to be policed while policy-maps define the action to be taken upon the selected traffic.
Policy-maps can drop, pass or inspect traffic. Because we want the firewall to watch traffic moving in the direction of zone-pairs, we will create inspect policy-maps. Inspect policy-maps allow for dynamic handling of the return traffic.
First, you will create class-maps. After the class-maps are created, you will create policy-maps and attach the class-maps to the policy-maps.

a. Create an inspect class-map to match traffic to be allowed from the INSIDE zone to the INTERNET zone.
Because we trust the INSIDE zone, we allow all the main protocols.

In the commands below, the first line creates an inspect class-map. The match-any keyword instructs the router that any of the match protocol statements will qualify as a successful match resulting in a policy being applied. The result is a match for TCP or UDP or ICMP packets.

The match commands refer to specific Cisco NBAR supported protocols. For more information on CiscoNBAR visit Cisco Network-Based Application Recognition.

R3(config)# class-map type inspect match-any INSIDE_PROTOCOLS
R3(config-cmap)# match protocol tcp
R3(config-cmap)# match protocol udp
R3(config-cmap)# match protocol icmp

b. Similarly, create a class-map to match the traffic to be allowed from the CONFROOM zone to the INTERNET zone. Because we do not fully trust the CONFROOM zone, we must limit what the server can send out to the Internet:

R3(config)# class-map type inspect match-any CONFROOM_PROTOCOLS 
R3(config-cmap)# match protocol http
R3(config-cmap)# match protocol https
R3(config-cmap)# match protocol dns

c. Now that the class-maps are created, you can create the policy-maps.

In the commands below, the first line creates an inspect policy-map named INSIDE_TO_INTERNET. The second line binds the previously created INSIDE_PROTOCOLS class-map to the policy-map. All packets matched by the INSIDE_PROTOCOLS class-map will be subjected to the action taken by the INSIDE_TO_INTERNET policy-map. Finally, the third line defines the actual action this policy-map will apply to the matched packets. In this case, the matched packets will be inspected.

The next three lines creates a similar policy-map named CONFROOM_TO_INTERNET and attaches the CONFROOM_PROTOCOLS class-map.

The commands are as follows:

R3(config)# policy-map type inspect INSIDE_TO_INTERNET
R3(config-pmap)# class type inspect INSIDE_PROTOCOLS
R3(config-pmap-c)# inspect
R3(config)# policy-map type inspect CONFROOM_TO_INTERNET
R3(config-pmap)# class type inspect CONFROOM_PROTOCOLS
R3(config-pmap-c)# inspect

Step 3: Create the Zone Pairs

A zone pair allows you to specify a unidirectional firewall policy between two security zones.

For example, a commonly used security policy dictates that the internal network can initiate any traffic towards the Internet but no traffic originating from the Internet should be allowed to reach the internal network.
This traffic policy requires only one zone pair, INTERNAL to INTERNET. Because zone-pairs define unidirectional traffic flow, another zone-pair must be created if Internet-initiated traffic must flow in the INTERNET to INTERNAL direction.
Notice that Cisco ZPF can be configured to inspect traffic that moves in the direction defined by the zone pair. In that situation, the firewall watches the traffic and dynamically creates rules allowing the return orrelated traffic to flow back through the router.

To define a zone pair, use the zone-pair security command. The direction of the traffic is specified bythe source and destination zones.

For this lab, you will create two zone-pairs:
INSIDE_TO_INTERNET: Allows traffic leaving the internal network towards the Internet.
CONFROOM_TO_INTERNET: Allows Internet access from the ConfRoom network.

a. Creating the zone-pairs:

R3(config)# zone-pair security INSIDE_TO_INTERNET source INSIDE destination INTERNET
R3(config)# zone-pair security CONFROOM_TO_INTERNET source CONFROOMdestination INTERNET

b. Verify the zone-pairs were correctly created by issuing the show zone-pair security command. Notice that no policies are associated with the zone-pairs yet. The security policies will be applied to zone-pairs in the next step.

R3# show zone-pair security
Zone-pair name INSIDE_TO_INTERNET
    Source-Zone INSIDE Destination-Zone INTERNET
service-policy not configured
Zone-pair name CONFROOM_TO_INTERNET
    Source-Zone CONFROOM Destination-Zone INTERNET
    service-policy not configured

Step 4: Applying Security Policies

a. As the last configuration step, apply the policy-maps to the zone-pairs:

R3(config)# zone-pair security INSIDE_TO_INTERNET
R3(config-sec-zone-pair)# service-policy type inspect INSIDE_TO_INTERNET
R3(config)# zone-pair security CONFROOM_TO_INTERNET
R3(config-sec-zone-pair)# service-policy type inspect CONFROOM_TO_INTERNET

b. Issue the show zone-pair security command once again to verify the zone-pair configuration. Notice that the service-polices are now displayed:

R3#show zone-pair security 
Zone-pair name INSIDE_TO_INTERNET
    Source-Zone INSIDE Destination-Zone INTERNET
    service-policy INSIDE_TO_INTERNET
Zone-pair name CONFROOM_TO_INTERNET
    Source-Zone CONFROOM Destination-Zone INTERNET 
    service-policy CONFROOM_TO_INTERNET

To obtain more information about the zone-pairs, their policy-maps, the class-maps and match counters, use the show policy-map type inspect zone-pair command:

R3#show policy-map type inspect zone-pair 
policy exists on zp INSIDE_TO_INTERNET
  Zone-pair: INSIDE_TO_INTERNET

  Service-policy inspect : INSIDE_TO_INTERNET

    Class-map: INSIDE_PROTOCOLS (match-any) 
      Match: protocol tcp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol udp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol icmp
0 packets, 0 bytes
30 second rate 0 bps

  Inspect
    Session creations since subsystem startup or last reset 0
    Current session counts (estab/half-open/terminating) [0:0:0]
    Maxever session counts (estab/half-open/terminating) [0:0:0]
    Last session created never
    Last statistic reset never
    Last session creation rate 0
    Maxever session creation rate 0
    Last half-open session total 0
    TCP reassembly statistics
    received 0 packets out-of-order; dropped 0
    peak memory usage 0 KB; current usage: 0 KB
    peak queue length 0

  Class-map: class-default (match-any) 
    Match: any 
    Drop
     0 packets, 0 bytes
[output omitted]

Step 5: Assign Interfaces to the Proper Security Zones

Interfaces (physical and logical) are assigned to security zones with the zone-member security interface command.

a. Assign R3’s G0/0 to the CONFROOM security zone:

R3(config)# interface g0/0
R3(config-if)# zone-member security CONFROOM

b. Assign R3’s G0/1 to the INSIDE security zone:

R3(config)# interface g0/1
R3(config-if)# zone-member security INSIDE

c. Assign R3’s S0/0/1 to the INTERNET security zone:

R3(config)# interface s0/0/1
R3(config-if)# zone-member security INTERNET

Step 6: Verify Zone Assignment

a. Issue the show zone security command to ensure the zones were properly created, and the interfaces were correctly assigned:

R3# show zone security
zone self
  Description: System defined zone

zone CONFROOM
  Member Interfaces:
    GigEthernet0/0

zone INSIDE
  Member Interfaces:
    GigEthernet0/1

zone INTERNET
  Member Interfaces:
    Serial0/0/1

b. Even though no commands were issued to create a “self” zone, the output above still displays it. Why is R3 displaying a zone named “self”? What is the significance of this zone?
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
The “self” zone is a special default security zone. This zone relates to traffic that originates in or is destined to the control plane of the router itself (e.g. routing protocols, SSH, SNMP, etc.). By default, all traffic is allowed into the “self” zone.

Part 3: ZPF Verification

Task 1: Verify ZPF Firewall Functionality

Step 1: Traffic originating on the Internet

a. To test the firewall’s effectiveness, ping PC-B from PC-A. In PC-A, open a command prompt and issue:

C:\Users\NetAcad> ping 192.168.3.3

Was the ping successful? Explain.
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
No. The ICMP packets sent by PC-A enter R3 through its Serial0/0/1 interface. Because R3’s serial 0/0/1 was assigned to the INTERNET zone, R3 correctly sees these ICMP packets as Internet originating packets. PC-B has an IP address of 192.168.3.3 which belongs to the IP range assigned to R3’s G0/1 interface. Because R3’s G0/1 was assigned to the INSIDE zone, R3 correctly assumes PC-B is a member of the INSIDE zone. Based on the security policy in place in R3, Internet originating packets should not be allowed to reach the internal network, and the ICMP packets generated by PC-A’s ping are dropped.

b.  Ping PC-C from PC-A. In PC-A, open a command window and issue

C:\Users\NetAcad> ping 192.168.33.3

Was the ping successful? Explain.
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
No. The ICMP packets sent by PC-A enter R3 through its Serial0/0/1 interface. Because R3’s serial 0/0/1 was assigned to the INTERNET zone, R3 correctly sees these ICMP packets as Internet originating packets. PC-C has an IP address of 192.168.33.3 which belongs to the IP range assigned to R3’s G0/0 interface. Because R3’s G0/0 was assigned to the CONFROOM zone, R3 correctly assumes PC-C is a member of the CONFROOM zone. Based on the security policy in place in R3, Internet originating packets should not be allowed to reach the conference room network, and the ICMP packets generated by PC-A’s ping are dropped.

c. Ping PC-A from PC-B. In PC-B, open a command window and issue

C:\Users\NetAcad> ping 192.168.1.3

d. Was the ping successful? Explain.
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
e. Yes. The ICMP packets sent by PC-B enter R3 through its G0/1 interface. Because R3’s G0/1 was assigned to the INSIDE zone, R3 correctly sees these ICMP packets as INSIDE originating packets. PCA has an IP address of192.168.1.3 which doesn’t belong any of R3’s networks; R3 must use its default route through R2 to reach this destination. Because the packets will exit R3 via R3’s s0/0/1 towards R2, R3 correctly concludes the ICMP packets are originating in the INSIDE zone towards the INTERNETzone. Based on the security policy in place in R3, INSIDE originating TCP, UDP and ICMP packets moving towards the INTERNET zone should be allowed; Therefore, the ICMP packets related to the ping can reach PC-A. Notice that because the relevant policy-maps and class-maps are configured to inspect the traffic, R3 automatically creates rules to allow the responses from PC-A to reach PC-B. The result is a successful ping between PC-B and PC-A.

f. Ping PC-A from PC-C. In PC-C, open a command window and issue

C:\Users\NetAcad> ping 192.168.1.3

g. Was the ping successful? Explain.
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________
_______________________________________________________________________________

h. No. The ICMP packets sent by PC-C enter R3 through its G0/0 interface. Because R3’s G0/0 was
assigned to the CONFROOM zone, R3 correctly sees these ICMP packets as ConfRoom originating packets. PC-A has an IPaddress of 192.168.1.3 which does not belong to any of R3’s networks; R3 must use its default route through R2 to reach this destination. Because the packets will exit R3 via R3’s s0/0/1 towards R2, R3 correctly concludes the ICMP packets are originating in the CONFROOM zone towards the INTERNET zone. Based on the security policy in place in R3, ConfRoom originating packets moving towards the INTERNET zone should only be allowed if they are HTTP or HTTPS or DNS packets. Since the ping generates ICMP packets, they are dropped and not able to reach PC-A.

Step 2: The Self Zone Verification

a. From PC-A ping R3’s G0/1 interface:

C:\Users\NetAcad> ping 192.168.3.1

Was the ping successful? Is this the correct behavior? Explain.
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
Yes, the ping is successful and yes, the behavior is correct. The security policy in place in R3 blocks Internet originating traffic going to the INSIDE or CONFROOM zones. While R3 sees the ICMP packets generated by PC-A as Internet originating traffic, the ICMP packets are targeting R3’s own IP assigned to G0/1. All of R3’s own IP addresses (10.2.2.1, 192.168.33.1 and 192.168.3.1) are considered part of the Self zone. Because no policies were explicitly configured for the Self Zone, R3 follows the default behavior and allows the packets.

b. From PC-C ping R3’s G0/1 interface:

C:\Users\NetAcad> ping 192.168.3.1

Was the ping successful? Is this the correct behavior? Explain.
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
Yes, the ping is successful and yes, the behavior is correct. The security policy in place in R3 blocks ConfRoom originating traffic going to the INSIDE zone. While R3 sees the ICMP packets generated by PC-C as ConfRoom originating traffic, the ICMP packets are targeting R3’s own IP assigned to G0/1. All of R3’s own IP addresses (10.2.2.1, 192.168.33.1 and 192.168.3.1) are considered part of the Self zone. Because no policies were explicitly configured for the Self Zone, R3 follows the default behavior and allows the packets.

Challenge (optional)

Create the proper zone-pair, class-maps, and policy-maps and configure R3 to prevent Internet originating traffic from reaching the Self Zone.

R3(config)#policy-map type inspect internet_to_self
R3(config-pmap)#class class-default
R3(config-pmap)#drop
R3(config)#zone-pair security INTERNET_to_Self source INTERNET destination self
R3(config-sec-zone-pair)#service-policy type inspect internet_to_self

Appendix – Multiple Interfaces under the Same Zone (optional)

One benefit of ZPF firewalls is that they scale well compared to the classic firewall. If a new interface with the same security requirements is added to the firewall, the administrator can simply add the new interface as a member of an existing security zone. However, some IOS versions will not allow devices connected to different interfaces of the same zone to communicate by default. In those cases, a zone-pair must be created using the same zone as source and destination.

Traffic between similarly zoned interfaces will always be bidirectional due the fact that the zone-pair’s source and destination zones are the same. Because of that, there is no need to inspect traffic to allow for automatic return traffic handling; return traffic will always be allowed because it will always conform to the zone-pair definition. In this case, the policy-map should have a pass action instead of inspect. Because of the passaction, the router will not inspect packets matched by the policy-map, it will simply forward it to its destination.

In the context of this lab, if R3 had a G0/2 interface also assigned to the INSIDE zone, and the router IOS version did not suppport allowing traffic between interfaces configured to the same zone, the extra configuration would look like this:

New zone-pair: Inside to Inside; allows routing of traffic among the internal trusted interfaces.

Creating the policy-map (notice that no explicit class-map is needed because we use the default “catch-all” class):

R3(config)# policy-map type inspect inside
R3(config-pmap)# class class-default
R3(config-pmap-c)# pass

Creating the zone-pair and assigning the new policy-map to it. Notice that the INSIDE zone is both the source
and the destination of the zone-pair:

R3(config)# zone-pair security INSIDE source INSIDE destination INSIDE
R3(config-sec-zone-pair)# service-policy type inspect inside

To verify the existence of the new pair, use show zone-pair security:

R3# show zone-pair security
  Zone-pair name INSIDE_TO_INTERNET
    Source-Zone INSIDE Destination-Zone INTERNET
    service-policy INSIDE_TO_INTERNET
  Zone-pair name CONFROOM_TO_INTERNET
    Source-Zone CONFROOM Destination-Zone INTERNET
    service-policy CONFROOM_TO_INTERNET
  Zone-pair name INSIDE
    Source-Zone INSIDE Destination-Zone INSIDE
    service-policy inside

Router Interface Summary Table

Basic Router Configs – Part 1

Note: ISR G2 devices have GigabitEthernet interfaces instead of FastEthernet Interfaces.

Router R1 after Part 1

R1#sh run
Building configuration...

Current configuration : 1631 bytes
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
enable secret 9 $9$/JfUcC.a9eM6hU$HOxQIIJeK2kYNJr1AIHctJoGXMU/0MhMie4IL6qRLCU
!
no aaa new-model
!
no ip domain lookup 
ip domain name ccnasecurity.com
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
cts logging verbose
!
username admin01 secret 9 
$9$UVV.Y/MDWs8vvk$6AP/Gu/M6gGvcRp1hW/Jg0tTwD4ZGeqZ6RooQmnJBfQ
!
redundancy
!
crypto key pubkey-chain rsa
 named-key realm-cisco.pub signature
 key-string
   30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
   00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16
   17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128
   B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E
   5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35
   FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85
   50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36
   006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE
   2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3
   F3020301 0001
  quit
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0/0
ip address 10.1.1.1 255.255.255.252
clock rate 64000
! 
interface Serial0/0/1
no ip address
shutdown
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 10.1.1.2
!
control-plane
!
!
line con 0
exec-timeout 5 0
logging synchronous
login local
line aux 0
exec-timeout 5 0
login local
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end

Router R2 after Part 1

R2#sh run
Building configuration...

Current configuration : 1668 bytes
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname R2
! 
boot-start-marker
boot-end-marker
!
enable secret 9 $9$/JfUcC.a9eM6hU$HOxQIIJeK2kYNJr1AIHctJoGXMU/0MhMie4IL6qRLCU
!
no aaa new-model
!
no ip domain lookup
ip domain name ccnasecurity.com!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
cts logging verbose
!
username admin01 secret 9 
$9$UVV.Y/MDWs8vvk$6AP/Gu/M6gGvcRp1hW/Jg0tTwD4ZGeqZ6RooQmnJBfQ
!
redundancy
!
crypto key pubkey-chain rsa
 named-key realm-cisco.pub signature
  key-string
   30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
   00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16
   17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128
   B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E
   5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35
   FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85
   50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36
   006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE
   2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3
   F3020301 0001
  quit
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address 
shutdown
duplex auto
speed auto
!
interface Serial0/0/0
ip address 10.1.1.2 255.255.255.252
!
interface Serial0/0/1
ip address 10.2.2.2 255.255.255.252
clock rate 64000
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 192.168.1.0 255.255.255.0 10.1.1.1
ip route 192.168.3.0 255.255.255.0 10.2.2.1
ip route 192.168.33.0 255.255.255.0 10.2.2.1
!
control-plane
!
line con 0
exec-timeout 5 0
logging synchronous
login local
line aux 0
exec-timeout 5 0
login local
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end

Router R3 after Part 1

R3#sh run
Building configuration...

Current configuration : 1623 bytes
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
enable secret 9 $9$/JfUcC.a9eM6hU$HOxQIIJeK2kYNJr1AIHctJoGXMU/0MhMie4IL6qRLCU
!
no aaa new-model
!
no ip domain lookup
ip domain name ccnasecurity.com
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
cts logging verbose
!
username admin01 secret 9 
$9$UVV.Y/MDWs8vvk$6AP/Gu/M6gGvcRp1hW/Jg0tTwD4ZGeqZ6RooQmnJBfQ
!
redundancy
!
crypto key pubkey-chain rsa
 named-key realm-cisco.pub signature
  key-string
   30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
   00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16
   17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128
   B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E
   5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35
   FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85
   50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36
   006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE
   2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3
   F3020301 0001
  quit
!
interface Embedded-Service-Engine0/0
no ip address 
shutdown
!
interface GigabitEthernet0/0
ip address 192.168.33.1 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
clock rate 125000
!
interface Serial0/0/1
ip address 10.2.2.1 255.255.255.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 10.2.2.2
!
control-plane
!
line con 0
exec-timeout 5 0
logging synchronous
login local
line aux 0
exec-timeout 5 0
login local
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20000 1000 
!
end

Router R3 after Part 2

R3#sh run
Building configuration...

Current configuration : 2503 bytes
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
no aaa new-model 
enable secret 9 $9$/JfUcC.a9eM6hU$HOxQIIJeK2kYNJr1AIHctJoGXMU/0MhMie4IL6qRLCU
!
no aaa new-model
!
no ip domain lookup
ip domain name ccnasecurity.com
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
cts logging verbose
!
username admin01 secret 9 
$9$UVV.Y/MDWs8vvk$6AP/Gu/M6gGvcRp1hW/Jg0tTwD4ZGeqZ6RooQmnJBfQ
!
redundancy
!
crypto key pubkey-chain rsa
 named-key realm-cisco.pub signature
  key-string
   30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
   00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16
   17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128
   B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E 
   5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35
   FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85
   50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36
   006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE
   2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3
   F3020301 0001
  quit!
class-map type inspect match-any CONFROOM_PROTOCOLS
match protocol http
match protocol https
match protocol dns
class-map type inspect match-any INSIDE_PROTOCOLS
match protocol tcp
match protocol udp
match protocol icmp
!
policy-map type inspect CONFROOM_TO_INTERNET
class type inspect CONFROOM_PROTOCOLS
inspect 
class class-default
drop
policy-map type inspect INSIDE_TO_INTERNET
class type inspect INSIDE_PROTOCOLS
inspect 
class class-default
drop
!
zone security INSIDE
zone security CONFROOM
zone security INTERNET
zone-pair security INSIDE_TO_INTERNET source INSIDE destination INTERNET
service-policy type inspect INSIDE_TO_INTERNET
zone-pair security CONFROOM_TO_INTERNET source CONFROOM destination Internet
service-policy type inspect CONFROOM_TO_INTERNET
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 192.168.33.1 255.255.255.0
zone-member security CONFROOM
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.168.3.1 255.255.255.0
zone-member security INSIDE
duplex auto 
speed auto
!
interface Serial0/0/0
no ip address
shutdown
clock rate 125000
!
interface Serial0/0/1
ip address 10.2.2.1 255.255.255.0
zone-member security Internet
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 10.2.2.2
!
control-plane
!
line con 0
exec-timeout 5 0
logging synchronous
login local
line aux 0
exec-timeout 5 0
login local
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end