Cisco IOS Zone-Based Firewall Step-by-step Configuration Guide

Introduction

The Cisco IOS Zone Based Firewall is one of the most advanced form of Stateful firewall used in Cisco IOS devices. The zone based firewall (ZBFW) is the successor of Classic IOS firewall or CBAC (Context-Based Access Control). Cisco first implemented the router-based stateful firewall in CBAC where it used ip inspect command to inspect the traffic in layer 4 and layer 7.

Even though ASA devices are considered as the dedicated firewall devices, Cisco integrated the firewall functionality in the router which in fact will make the firewall a cost effective device. The zone based firewall came up with many more features that is not available in CBAC. The ZBFW mainly deals with the security zones, where we can assign router interfaces to various security zones and control the traffic between the zones. Also the traffic will be dynamically inspected as it passes through the zones. In addition to all the features which is available in classic IOS firewall, Zone based firewall will support Application inspection and control for HTTP, POP3, Sun RPC, IM Applications and P2P File sharing.

For Advanced Configuration visit Zone Based Firewall Advanced Configuration

Zone Based Firewall Vs CBAC

CBAC	Zone Based Firewall
Interface Based Configuration	Zone Based Configuration
Controls Inbound and Outbound access on an interface	Controls Bidirectional access between zones.
Uses inspect statements and stateful ACLs	Uses Class-Based Policy language
-Not supported-	Support Application Inspection and Control
Support from IOS Release 11.2	Support from IOS Release 12.4 (6) T

• This document is a Step-by-step guide to configure a basic zone based policy firewall in an IOS Router. This example is based on a 2900 series router running with 15.0(1) code.

ZBFW Configuration Tasks

The below are the configuration tasks that you need to follow.

1. Configure Zones.

2. Assign router interfaces to Zones.

3. Create Zone pairs.

4. Configure Interzone access policy (Class Maps and Policy Maps)

5. Apply Policy Maps to Zone Pairs.

Network Diagram

The ZBFW configuration is based on the below network diagram.

Figure 1:

In this example we have three zones.

• Inside Zone - Private LAN
• DMZ Zone  - DMZ hosts
• Outside Zone - Internet

Here I am defining a rule set for our ZBFW:

1. From Inside to Outside - http, tcp, udp, icmp and pop3 is allowed.

2. From Outside to Inside - icmp is allowed.

3. From Inside to DMZ - http, tcp and icmp is allowed

4. From Outside to DMZ - http is allowed

Default Rules of Zone Based Firewall

1. Interzone communication is Denied, traffic will be denied among the interfaces that are in the different zones unless we specify a firewall policy.

2. Intrazone communication is Allowed, traffic will flow implicitly among the interfaces that are in the same zone.

3. All traffic to self zone is Allowed.

Task 1 : Configure Zones

In this example (refer figure 1) we have got three zones. Inside, Outside and DMZ.

To configure zones in a router, connect the router via ssh or console, switch to the global configuration mode and type the command as below:

Router(config)#zone security INSIDE

Router(config)#zone security OUTSIDE

Router(config)#zone security DMZ

Task 2 : Assign Router Interface to Zones

We have to assign the router interface to a particular zone. Here I am going to assign Gigabyte Ethernet 0/0 to INSIDE zone, Ge0/1 to OUTSIDE zone and Ge0/2 to DMZ zone.

To achieve this we have to go to the particular interface and attach that interface to the zone. Type the command as below:

Router(config)#interface gigabitEthernet 0/0
Router(config-if)#zone-member securtiy INSIDE

Router(config)#interface gigabitEthernet 0/1
Router(config-if)#zone-member securtiy OUTSIDE

Router(config)#interface gigabitEthernet 0/2
Router(config-if)#zone-member securtiy DMZ
   

Now if you try to ping a zone from another zone the traffic will be denied because of the default firewall policy.

Task 3 : Create Zone Pairs

Zone pairs are created to connect the zones. If you want to make two zones to communicate you have to create zone pairs. DO NOT create zone pairs for non-communicating zones. In our scenario the traffic flows between:

• INSIDE to OUTSIDE
• OUTSIDE to INSIDE
• OUTSIDE to DMZ
• INSIDE to DMZ

So we need to create zone pair for all the four pairs. To create zone pair type the command as follows in global configuration mode.

Router(config)#zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE

Router(config)#zone-pair security OUT-TO-IN source OUTSIDE destination INSIDE

Router(config)#zone-pair security OUT-TO-DMZ source OUTSIDE destination DMZ

Router(config)#zone-pair security IN-TO-DMZ source INSIDE destination DMZ

Task 4 : Configure Interzone Access Policy

Interzone Access policy is the key part of a zone based firewall where we classify the traffic and apply the firewall policies. Here we are defining the class-map and policy-map for classifying and defining policy to the traffic.

Class Maps : This will classify the traffic

Policy Maps : This will decide the 'fate' of the traffic.

Class Map Configuration

Class map sort the traffic based on the following criteria 1.) Access-group 2.) Protocol 3.) A subordinate class map. In this example we are sorting the traffic based on access group. So first we need to create an ACL and associate it with the class map.

a.) Class Map for INSIDE-TO-OUTSIDE

Router(config)#ip access-list extended INSIDE-TO-OUTSIDE
Router(config-ext-nacl)#permit tcp 172.17.0.0 0.0.255.255 any eq www
Router(config-ext-nacl)#permit tcp 172.17.0.0 0.0.255.255 any eq echo
Router(config-ext-nacl)#permit tcp 172.17.0.0 0.0.255.255 any eq pop3

Router(config)#class-map type inspect match-all INSIDE-TO-OUTSIDE-CLASS
Router(config-cmap)#match access-group name INSIDE-TO-OUTSIDE

b.) Class Map for OUTSIDE-TO-INSIDE

Router(config)#ip access-list extended OUTSIDE-TO-INSIDE
Router(config-ext-nacl)#permit tcp any 172.17.0.0 0.0.255.255 eq echo

Router(config)#class-map type inspect match-all OUTSIDE-TO-INSIDE-CLASS
Router(config-cmap)match access-group name OUTSIDE-TO-INSIDE

c.) Class Map for OUTSIDE-TO-DMZ

Router(config)#ip access-list extended OUTSIDE-TO-DMZ
Router(config-ext-nacl)#permit tcp any 192.168.1.0 0.0.0.255 eq www

Router(config)#class-map type inspect match-all OUTSIDE-TO-DMZ-CLASS
Router(config)#match access-group name OUTSIDE-TO-DMZ

d.) Class Map for INSIDE-TO-DMZ

Router(config)#ip access-list extended INSIDE-TO-DMZ
Router(config-ext-nacl)#permit tcp 172.17.0.0 0.0.255.255 192.168.1.0 0.0.0.255 eq www
Router(config-ext-nacl)#permit tcp 172.17.0.0 0.0.255.255 192.168.1.0 0.0.0.255 eq echo

Router(config)#class-map type inspect match-all INSIDE-TO-DMZ-CLASS
Router(config-cmap)#match access-group name INSIDE-TO-DMZ



Policy-Map Configuration

Policy-Maps will apply the firewall policy to the class-map that is configured previously. Three actions can be taken aganist the traffic with the policy-map configuration:

• Inspect : Dynamically inspect the traffic
• Drop : Drop the traffic
• Pass : Simply forward the traffic.

There will be a drop policy, by default, at the end of the policy-map.

a.) Policy-map for INSIDE-TO-OUTSIDE

Router(config)#policy-map type inspect INSIDE-TO-OUTSIDE-POLICY
Router(config-pmap)#class type inspect INSIDE-TO-OUTSIDE-CLASS
Router(config-pmap)#inspect
Router(config-pmap)#class class-default
Router(config-pmap)#drop log

b.) Policy-map for OUTSIDE-TO-INSIDE

Router(config)#policy-map type inspect OUTSIDE-TO-INSIDE-POLICY
Router(config-pmap)#class type inspect OUTSIDE-TO-INSIDE-CLASS
Router(config-pmap)#inspect
Router(config-pmap)#class class-default
Router(config-pmap)#drop log

c.) Policy-map for OUTSIDE-TO-DMZ

Router(config)#policy-map type inspect OUTSIDE-TO-DMZ-POLICY
Router(config-pmap)#class type inspect OUTSIDE-TO-DMZ-CLASS
Router(config-pmap)#inspect
Router(config-pmap)#class class-default
Router(config-pmap)#drop

d.) Policy-map for INSIDE-TO-DMZ

Router(config)#policy-map type inspect INSIDE-TO-DMZ-POLICY
Router(config-pmap)#class type inspect INSIDE-TO-DMZ-CLASS
Router(config-pmap)#pass
Router(config-pmap)#class class-default
Router(config-pmap)#drop log

Task 5 : Apply policy-maps to zone pairs

Now we have to attach the policy maps to the zone pairs that we already created. The command is as follows:

Router(config)#zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
Router(config-sec-zone-pair)#service-policy type inspect INSIDE-TO-OUTSIDE-POLICY

Router(config)#zone-pair security OUT-TO-IN source OUTSIDE destination INSIDE
Router(config-sec-zone-pair)#service-policy type inspect OUTSIDE-TO-INSIDE-POLICY

Router(config)#zone-pair security OUT-TO-DMZ source OUTSIDE destination DMZ
Router(config-sec-zone-pair)#service-policy type inspect OUTSIDE-TO-DMZ-POLICY

Router(config)#zone-pair security IN-TO-DMZ source INSIDE destination DMZ
Router(config-sec-zone-pair)#service-policy type inspect INSIDE-TO-DMZ-POLICY

There we finish the basic configuration of a zone based firewall.

Troubleshooting

Below you can find a list of commands for zone based firewall troubleshooting.

a.) Show Commands

show class-map type inspect

show policy-map type inspect

show zone-pair security

b.) Debug Commands*

*Use the debug command with great care.

debug policy-firewall detail

debug policy-firewall events

debug policy-firewall protocol tcp

debug policy-firewall protocol udp

Useful Links

• http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/15-1s/sec-zone-pol-fw.html
• Zone Based Firewall Advanced Configuration 
• http://www.cisco.com/en/US/docs/routers/access/cisco_router_and_security_device_manager/24/software/user/guide/C3PL.html
• http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00808bc994.shtml
• http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5710/ps1018/prod_white_paper0900aecd8062a909.html 
• http://yadhutony.blogspot.in/2012/11/how-to-block-p2p-traffic-on-cisco-router.html
• http://yadhutony.blogspot.in/2013/02/cisco-ios-local-content-filtering.html