Understanding Zone Based Firewalls
One of the new topics to the blueprint is zone based firewalls, in my head (and possibly not in reality) its like CBAC with some extra bells and whistles but between virtual zones, I wasn’t particularly hot on the subject but after a review its really not that bad, you have have to follow the key steps.
1. Define your security zones
Firstly choose what security zones you wish to define, you can choose almost any name you like I have just chosen internal and external for my test, there’s no reason why you couldn’t have 3, 4 or more zones if required. There is a default zone called “local” which is for traffic originated/sent to the router as opposed to passing through it. So as far as I am aware if you don’t play around with the local zone it shouldn’t affect traffic your routing protocol traffic, as it does not pass through it. Define the zones with the following commands;
Router(config)#zone security internal Router(config-sec-zone)#exit Router(config)#zone security external Router(config-sec-zone)#exit
2. Assign interfaces to the relevant zones
Under each interface you wish to link to a zone go under the interface and use the following command where the interface is linked to the zone “internal”.
Router(config-if)#zone-member security internal
3. Define your class maps
Split your traffic up into classes and make sure you use “type inspect” option when defining them, the simple one below uses NBAR to classify http packets. I wont explain class or policy maps in much detail as most other candidates should be familiar with them from MQC.
class-map type inspect match-all http match protocol http
4. Tie up the class maps in a policy map
Now to define the action for each of the classes defined in the class maps, make sure you use the “inspect” option if you wish to inspect the traffic to allow return traffic. In the example below I have named the policy zonebasedfw.
policy-map type inspect zonebasedfw class type inspect http inspect class class-default drop
5. Tie it all together in a zone pair
Finally create a zone pair with your own name I chose “internal-to-external”, define your source and destination zones and the pre defined policy.
zone-pair security internal-to-external source internal destination external service-policy type inspect zonebasedfw
Verification
There are 2 handy verification commands which I am aware of, firstly sh zone security as shown below, this indicates which interfaces are linked to which zone;
Router#sh zone security
zone self
Description: System defined zone
zone internal
Member Interfaces:
FastEthernet0/0
FastEthernet1/0
zone external
Member Interfaces:
FastEthernet0/1
And sh zone-pair security which shows the details from the zone pair, notably which policy has been applied in which direction.
Router#sh zone-pair security
Zone-pair name internal-to-external
Source-Zone internal Destination-Zone external
service-policy zonebasedfw
