Transparent Firewall (IOS) and CBAC.

Sometimes you have to implement L2 firewall in your network. There are many reasons to choose this solution and one of them is to preserve your L3 design. On Cisco routers you can implement IRB (Integrated Routing & Bridging) or CRB (Concurrent Routing & Bridging). The first one allows on exchanging traffic between routed and bridged interfaces. While CRB totally separate these types of traffic (L2 and L3). If you need L3 interface together with L2 you have to add BVI interface with IP from the same subnet as its neighbors.

IRB (with BVI interface): #

bridge irb
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 bridge-group 1
!
interface GigabitEthernet0/1.20
 encapsulation dot1Q 20
 bridge-group 1
!
interface BVI1
 ip address 31.31.31.31 255.255.255.0
!
bridge 1 protocol ieee
!

IRB (without BVI interface): #

bridge irb
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 bridge-group 1
!
interface GigabitEthernet0/1.20
 encapsulation dot1Q 20
 bridge-group 1
!
bridge 1 protocol ieee
!
no ip routing
!

CRB: #

bridge crb
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 bridge-group 1
!
interface GigabitEthernet0/1.20
 encapsulation dot1Q 20
 bridge-group 1
!
bridge 1 protocol ieee
!
no ip routing
!

Now, we implement the CBAC and we inspect icmp and tcp:

         OUTSIDE     L2 firewall       INSIDE
      [31.31.31.100]                 [31.31.31.2] 
          /----\        /----\         /----\ 
         |  R1  |------|  R2  |-------| Win  |
          \----/      / \----/ \       \----/ 
                  gig0/0.10 gig0/1.20  
                      icmp, tcp

                      <---------           

R2:
ip inspect name L2-FW1 tcp
ip inspect name L2-FW1 icmp alert on
!
interface GigabitEthernet0/1.20
 encapsulation dot1Q 20
 ip inspect L2-FW1 in
 no ip route-cache
 bridge-group 1
!

Let’s do some tests:

a) Win —> R1 (inside->outside)- ping:

C:\Documents and Settings\LabXP14>ping 31.31.31.100 -t
Pinging 31.31.31.100 with 32 bytes of data:
Reply from 31.31.31.100: bytes=32 time=1ms TTL=255
Reply from 31.31.31.100: bytes=32 time<1ms TTL=255
Reply from 31.31.31.100: bytes=32 time<1ms TTL=255
Reply from 31.31.31.100: bytes=32 time<1ms TTL=255
Ping statistics for 31.31.31.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

We check if the FW sees the session:

r2#sh ip inspect sessions 
Established Sessions
 Session 312374B4 (31.31.31.2:8)=>(31.31.31.100:0) icmp SIS_OPEN
r2#

b) Win —> R1 (inside->outside)- telnet:

telnet 31.31.31.100

r2#sh ip inspect sessions 
Established Sessions
Session 31237294 (31.31.31.2:2452)=>(31.31.31.100:23) tcp SIS_OPEN
r2#

Let’s try to initiate traffic from R1 to Win (outside->inside):

a) telnet:

r2#sh ip inspect sessions 
Established Sessions
 Session 31237294 (31.31.31.2:2452)=>(31.31.31.100:23) tcp SIS_OPEN
r2#

b) ping:

r2#sh ip inspect sessions 
Established Sessions
 Session 312374B4 (31.31.31.2:8)=>(31.31.31.100:0) icmp SIS_OPEN
r2#

As we see from above tests we inspect traffic from the Windows client to R1 but we still can send any non-inspected traffic through the firewall in both directions. There is no implicit deny at the end of the inspection rule and to protect our network we have to apply the ACL. In our case we apply the ACL on our OUTSIDE with direction ‘in’:

r2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r2(config)#access-list 101 deny   ip any any log
r2(config)#int gig0/0.10 
r2(config-subif)#ip access-group 101 in 
r2(config-subif)#end
r2#

r2#sh ip access-lists 
Extended IP access list 101
    10 deny ip any any log (2 matches)
r2#

Let’s try again send traffic from R1 to the Windows client (outside->inside):

r1#telnet 31.31.31.2
Trying 31.31.31.2 ...

On the firewall we can see the log message:

r2#
*Apr 14 20:55:20.262: %SEC-6-IPACCESSLOGP: list 101 denied tcp 31.31.31.100(33479) -> 31.31.31.2(23), 1 packet  

Let’s try ping:

r1#ping 31.31.31.2  

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 31.31.31.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r1#

r2#
*Apr 14 20:56:48.574: %SEC-6-IPACCESSLOGDP: list 101 denied icmp 31.31.31.100 -> 31.31.31.2 (8/0), 11 packets

And now when we send traffic from the Windows client to R1 we see on the firewall following sessions:

r2#sh ip inspect sessions 
Established Sessions
 Session 31237294 (31.31.31.2:8)=>(31.31.31.100:0) icmp SIS_OPEN
 Session 312374B4 (31.31.31.2:2455)=>(31.31.31.100:23) tcp SIS_OPEN
r2#

It means that returning traffic which is already inspected is not controlled by the ACL applied on the OUTSIDE interface.
The newer version of firewall - the Zone Base Firewall (ZBF) - doesn’t allow on any non-inspected traffic by default and you don’t have to apply any ACL like with CBAC.