Zone Base Firewall Policy

ZBFP is a successor of CBAC and it is the most flexible firewall implementation available on IOS. The main idea is to think about zones, not physical interfaces. With CBAC you couldn’t build policy based on flow or direction. For example a policy applied on OUTSIDE interface works the same for traffic to DMZ and to LAN. ZBFP can easily separate these flows and you can have two different rules depending on out interface. Let’s test one scenario:

I’m going to add a policy for traffic from R2 to R3. Only telnet and icmp should be allowed.

First I create a class and policy map:

!
class-map type inspect match-any CM-ICMP-TCP
 match protocol icmp
 match protocol tcp
!
policy-map type inspect PM-ICMP-TCP
 class type inspect CM-ICMP-TCP
  inspect
 class class-default
!

and then zones and a service policy:

!
zone security INSIDE
zone security OUTSIDE
!
zone-pair security INS->OUT source INSIDE destination OUTSIDE
 service-policy type inspect PM-ICMP-TCP
!

Last step is to add interfaces to the zones:

!
interface FastEthernet0/0
 ip address 5.5.5.1 255.255.255.0
!
interface FastEthernet1/0
 ip address 4.4.4.1 255.255.255.0
 zone-member security OUTSIDE
!
interface FastEthernet1/1
 ip address 2.2.2.1 255.255.255.0
 zone-member security INSIDE
!
interface FastEthernet2/0
 ip address 3.3.3.1 255.255.255.0
!

As you see only two interfaces are part of ZBFP configuration. Let’s test it:

R2#telnet 4.4.4.3
Trying 4.4.4.3 ... Open


Password required, but none set

[Connection to 4.4.4.3 closed by foreign host]
R2#

R2#ping 4.4.4.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 256/273/320 ms
R2#

On the R1 we can see following sessions:

R1#sh policy-map type inspect zone-pair sessions
 Zone-pair: INS->OUT

  Service-policy inspect : PM-ICMP-TCP

    Class-map: CM-ICMP-TCP (match-any)
      Match: protocol icmp
        1 packets, 80 bytes
        30 second rate 0 bps
      Match: protocol tcp
        2 packets, 48 bytes
        30 second rate 0 bps
      Inspect
        Established Sessions
         Session 6672C230 (2.2.2.2:8)=>(4.4.4.3:0) icmp SIS_OPEN
          Created 00:00:05, Last heard 00:00:04
           ECHO request
          Bytes sent (initiator:responder) [360:360]

    Class-map: class-default (match-any)
      Match: any
      Drop (default action)
        0 packets, 0 bytes
R1#

and

R1#sh policy-map type inspect zone-pair sessions
 Zone-pair: INS->OUT

  Service-policy inspect : PM-ICMP-TCP

    Class-map: CM-ICMP-TCP (match-any)
      Match: protocol icmp
        1 packets, 80 bytes
        30 second rate 0 bps
      Match: protocol tcp
        4 packets, 96 bytes
        30 second rate 0 bps
      Inspect
        Established Sessions
         Session 6672C230 (2.2.2.2:19243)=>(4.4.4.3:23) tcp SIS_OPEN
          Created 00:00:00, Last heard 00:00:00
          Bytes sent (initiator:responder) [24:49]

    Class-map: class-default (match-any)
      Match: any
      Drop (default action)
        0 packets, 0 bytes
R1#

As you can see the policy works as expected. Let’s test now if traffic between interfaces which are not part of ZBFP is allowed (R5->R4) and if traffic between zone member and non-zone member is allowed (R2->R4).

R5->R4:

R5#ping 5.5.5.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 132/166/224 ms
R5#telnet 5.5.5.4
Trying 5.5.5.4 ... Open


Password required, but none set

[Connection to 5.5.5.4 closed by foreign host]
R5#

R2->R4:

R2#ping 5.5.5.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2#

R2#telnet 5.5.5.4
Trying 5.5.5.4 ...
% Connection timed out; remote host not responding

R2#

Conclusions:

1) if you have interfaces that are members of zones, traffic from/to interface that is not part of any zone and such zone pair doesn’t exist, is not allowed

2) if you have a ZBFP configured on router, traffic between interfaces that are not members of any zone is not controlled by the ZBFP and by default is permitted.