All Cisco-Network Study Notes

Configuring Zone-Based Policy Firewall

ZFW does not use the classical CBAC ip audit command set. ZFW behavior are configured with the new Cisco

Policy Language (CPL), which employs a hierarchical anatomy to ascertain analysis for arrangement protocols and the

groups of hosts to which the analysis will be applied. Note that the two agreement models (Classical CBAC

and new ZFW) can be acclimated accordingly on the aforementioned router; however, they cannot be accumulated on the same

interface overlapping anniversary other. An interface cannot be configured as a area affiliate and be configured for ip

inspect simultaneously.

Note

It is important to accept that ZFW absolutely changes the agreement syntax for Cisco IOS

Firewall stateful inspection, as compared to Classical CBAC.

Security Zones

Security Zones authorize the aegis boundaries of the arrangement area cartage is subjected to action restrictions

as it crosses to addition arena aural the network.

As apparent in Figure 5-7, a area can accept one or added interface(s) assigned to it. This archetype shows a Cisco

IOS Firewall router with four interfaces and three zones:

Interface #1 affiliated to the Accessible Internet zone

Interfaces #2 and #3 affiliated to a Clandestine area abutting book servers and audience on a LAN (on

separate concrete interfaces, but in the aforementioned aegis zone), which charge not be attainable from the public

Internet

Interface #4 affiliated to the DMZ zone, abutting a web server and Domain Name System (DNS)

server, which charge be attainable to the accessible Internet

Figure 5-7. Basic Aegis Zone

[View abounding admeasurement image]

In the archetype illustrated by Figure 5-7, the IOS Firewall will about accept three capital aegis policies:

Private area connectivity to the Internet

Private area connectivity to DMZ

Public area connectivity to DMZ

Devices affiliated in the clandestine area would be able to canyon cartage to all added accessories amid interface #2

and #3 because they are in the aforementioned Clandestine zone. If an added new interface is added to the Clandestine zone,

inter-interface and intra-interface cartage is accustomed aural the aforementioned zone. Additionally, the hosts' cartage to hosts

in added zones would be analogously afflicted by absolute policies.

Zone-Based Action Overview

Before the ZFW was introduced, the Cisco IOS Firewall offered stateful analysis application the CBAC feature. CBAC

was covered in detail in the antecedent sections of this chapter.

In the contempo releases of Cisco IOS Software from Version 12.4(6)T and later, the CBAC archetypal is actuality replaced

with the new agreement archetypal that uses ZFW.

This new affection was added mainly to affected the limitations of the CBAC that was employing stateful

inspection action on an interface-based model. To be specific, the limitation was that all cartage casual through

the interface was accountable to the aforementioned analysis policy, thereby attached the granularity and action enforcement,

particularly in scenarios area assorted interfaces existed.

With ZFW, stateful analysis can now be activated on a zone-based model. Interfaces are assigned to zones, and

policy analysis is activated to cartage affective amid zones. This accessory provides added granularity,

flexibility, scalability, and an easy-to-use zone-based aegis approach. With a zone-based analysis model,

varying interzone behavior can be activated to assorted hosts or groups of hosts affiliated to the aforementioned interface.

Tip

The afterward Cisco whitepaper URL provides added capacity on the conceptual aberration amid Cisco

IOS Classic and ZFW features:

www.cisco.com/en/US/products/sw/secursw/ps1018/products_white_paper0900aecd806f31f9.shtml.

Zone-Based Policy Firewall (ZFW)

The new ZFW affection was alien in Cisco IOS Software Release 12.4(6)T for the added Cisco IOS

Firewall affection set.

All appearance from above-mentioned to IOS Software Release 12.4(6)T are across-the-board in this new accomplishing and are

supported in the new zone-based inspection.

ZFW supports the afterward features:

Stateful packet Analysis (SPI)

VRF-aware Cisco IOS Firewall

URL filtering

Denial-of-service (DoS) mitigation

More ZFW appearance were added into Cisco IOS Software Release 12.4(9)T for per-class session/connection and

throughput limits, as able-bodied as appliance analysis and control:

HTTP

Post Office Protocol (POP3)

Internet Mail Access Protocol (IMAP)

Simple Mail Transfer Protocol and Added Simple Mail Transfer Protocol (SMTP/ESMTP)

Sun Remote Procedure Call (RPC)

Instant Messaging (IM) applications, including Microsoft Messenger (MSN), Yahoo Messenger, and AOL

Instant Messenger

Peer-to-peer (P2P) book sharing, including Bittorrent, KaZaA, Gnutella, and eDonkey

Note

Stateful analysis for multicast cartage is not accurate in ZFW or bequest archetypal Firewall CBAC.

Inspection of Router-Generated Traffic

The Cisco IOS Firewall affection is added to abutment analysis for cartage that was originated by or destined to the CBACconfigured

device. Analysis of router-generated cartage augments CBAC functionality to audit TCP, UDP, and H.323

connections that accept the firewall as one of the affiliation endpoints. CBAC dynamically opens acting holes for TCP,

UDP, and H.323 ascendancy approach admission to and from the router, and for the abstracts and media channels adjourned over

the H.323 ascendancy channels. For example, CBAC can be configured to audit a Telnet accomplished from the CBAC-enabled router

to a accessory in the caught zone, acceptance acknowledgment cartage dynamically after defective to absolutely admittance in the admission list.

To accredit the Router-Generated Cartage analysis feature, use the router-traffic keyword in the ip audit name

command back configuring CBAC analysis rules. This advantage is accessible for H.323, TCP, and UDP protocols only.

This affection was alien in IOS Version 12.3(14)T.