Zone Based Firewall Configuration Example

Lessons Discussion
1

This topic is to discuss the following lesson:

2

Hello René

Networklessones.com is very informative… :slight_smile:

thank you…

3

Glad you like it :slight_smile:

4

Hi Rene,

Really good post to understand the concepts behind the zone based firewall.

Can you advise under what kind of network environments you would use zone based firewall?

Thank you,
Jay

5

Hi Jay,

The Zone Based Firewall is nice to use if you have an ISR with many interfaces that doesn’t run too much traffic and when you don’t have the budget to buy a separate firewall.

Rene

6

Thank you Rene . Clean , Simple and very informative.

7

Thanks a lot for writing this post. It helped me so much!

8

Thanks! very helpful!

9

Glad to be of service!

10

Hi Rene

What if i would like to inspet protocol which is unavaible i NBAR?
How can create my own “protocols” to inspect

Thanks
Luck

11

Hi Rene,

First of all thanks a lot for the very nice posts.

I was trying the same example but the only difference is that i was trying to inspect http traffic (match protocol http). Therefore when i try to generate some web traffic from the VM web browser, the http traffic is blocked. Once i changed the same class-map to the below it works. My question is why when matching http only the web traffic is blocked.

ip access-list extended ANY
  permit ip any any 
class-map type inspect LAN-TO-WAN
 match access-group name ANY
12

Hi Luck,

NBAR is the “lazy” way to match certain protocols. If NBAR doesn’t support your protocol then you have two options:

  • Use an Access-list to match on the protocol (TCP/UDP/ICMP/etc) and the port numbers.

OR

  • You can create custom protocols for NBAR, you’ll have more options but it’s also a bit more complicated. Take a look here to see what I mean:

Hope that helps,

Rene

13

Hello,

Thanks a lot for your explanations regarding the self zone, I’ve been looking for some simple examples and you got it right to the point.

Keep up the good work,

Lionel

14

You are welcome Lionel.

15

Hi Houssam,

If i understand you correctly, with “match protocol http” you were unable to get HTTP traffic inspected so the return traffic was allowed? That should work. What do you see with the show commands or when you enable a debug?

The access-list/class-map example that you have will allow everything from LAN > WAN, including HTTP.

Rene

16

Hello Rene,

Excellent article about zone based firewall. Very informative and easy to read and understand the concepts. Thanks.

Regards,
Maros

17

Hi Maros,

Thank you, I’m glad to hear that it was useful!

Rene

18

that was useful
thanks a lot

19

Hi rene,

i want to ask,
in service policy , they have drop, pass, and inspect…
i try to use drop and pass, and it still block the traffic…
so what difference with drop,pass, and inspect…

20

Hi John,

Good question…

When you use drop, the packet is discarded right away.

When you use pass…the packet is allowed outbound but there won’t be a rule for the return traffic so it will be dropped inbound.

Inspect will allow the packet outbound but also automatically creates a rule for the return traffic so that it is allowed inbound.

Does that make sense?

Rene

1 Like