Zone Base Firewall Policy - self zone
In my last post I tested some features of ZBFP and how traffic is processed by the firewall and some interfaces are not part of ZBFP configuration. Today I’d like to test ‘self-zone’ because it works a bit different. I’m going to work on a configuration from my last post.
As you remember I created policy for traffic from R2 to R3. I also tested connection from R2 to R4 and it didn’t work (R4 is not a member of any zone) but traffic from R5 to R4 is allowed (both are not members of any zone).
With ‘self-zone’ is works a bit different. Let’s do one test:
R2->R1:
R2#ping 2.2.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 64/95/128 ms
R2#
R5->R1:
R5#ping 5.5.5.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 92/122/132 ms
R5#
As you see both flows are permitted despite a self-zone exists but I don’t have any policy for any zone pair.
I added following configuration:
class-map type inspect match-any CM-TCP
match protocol tcp
policy-map type inspect PM-TCP
class type inspect CM-TCP
inspect
zone-pair security INS->SELF source INSIDE destination self
service-policy type inspect PM-TCP
it means I should be able telnet from R2 to R1 but I can’t ping:
R2#telnet 2.2.2.1
Trying 2.2.2.1 ... Open
Password required, but none set
[Connection to 2.2.2.1 closed by foreign host]
R2#
On R1 I can see:
Zone-pair: INS->SELF
Service-policy inspect : PM-TCP
Class-map: CM-TCP (match-any)
Match: protocol tcp
2 packets, 48 bytes
30 second rate 0 bps
Inspect
Established Sessions
Session 6672BF70 (2.2.2.2:44315)=>(2.2.2.1:23) tcp SIS_OPEN
Created 00:00:00, Last heard 00:00:00
Bytes sent (initiator:responder) [24:49]
Class-map: class-default (match-any)
Match: any
Drop (default action)
5 packets, 400 bytes
R1#
Let’s test a ping now:
R2#ping 2.2.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2#
On R1 we can see 10 packets dropped matched by the class-default:
Zone-pair: INS->SELF
Service-policy inspect : PM-TCP
Class-map: CM-TCP (match-any)
Match: protocol tcp
2 packets, 48 bytes
30 second rate 0 bps
Inspect
Class-map: class-default (match-any)
Match: any
Drop (default action)
10 packets, 800 bytes
R1#
Let’s do the same tests but from R1 to R2:
R1#ping 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#telnet 2.2.2.2
Trying 2.2.2.2 ...
% Connection timed out; remote host not responding
R1#
As you see both failed what means that despite lack of SELF-INS policy the returning packets are matched by INS-SELF policy. The policy action is ‘inspect’ and ZBFP checks if such session exists. In my case they didn’t exist and it was dropped. Once I change the action from ‘inspect’ to ‘pass’ one of them should work:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#policy-map type inspect PM-TCP
R1(config-pmap)# class type inspect CM-TCP
R1(config-pmap-c)#no inspect
R1(config-pmap-c)#pass
R1(config-pmap-c)#end
R1#
R1#ping 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#telnet 2.2.2.2
Trying 2.2.2.2 ... Open
Password required, but none set
[Connection to 2.2.2.2 closed by foreign host]
R1#
So ping doesn’t work as there is no policy in place for icmp. Telnet works fine as it is allowed in INS->SELF policy and the action ‘pass’ doesn’t check a sessions table.
From R1 I can ping and telnet others:
R1#telnet 5.5.5.4
Trying 5.5.5.4 ... Open
Password required, but none set
[Connection to 5.5.5.4 closed by foreign host]
R1#
R1#ping 5.5.5.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/68/96 ms
R1#ping 4.4.4.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/107/128 ms
R1#telnet 4.4.4.3
Trying 4.4.4.3 ... Open
Password required, but none set
[Connection to 4.4.4.3 closed by foreign host]
R1#
Let’s summarize what we learned so far (from previous post too):
Self-zone:
without any policy traffic is allowed from and to ZBFP device
once we define a zone pair (with self zone) in one direction, it has an impact on traffic to and from the firewall
if one protocol is not allowed in one direction, you can’t connect in the opposite direction as well as returning packets are dropped
if one protocol is allowed in one direction and the action is ‘inspect’, the opposite direction is not allowed as well as the policy will check if such session exists in the session table. Once you change the action to ‘pass’ it will work
traffic from and to hosts connected to different interfaces is not restricted
for routing protocols action ‘inspect’ is not allowed, you can only ‘pass’ (due to the multicast protocol)
Standard zone:
if you have interfaces that are members of zones, traffic from/to interface that is not part of any zone and such zone pair doesn’t exist, is not allowed
if you have a ZBFP configured on router, traffic between interfaces that are not members of any zone is not controlled by the ZBFP and by default is permitted.