Build an inside, DMZ and outside policy with the IOS zone-based firewall

Cisco IOSWorking

Turn branch router R1 into a stateful firewall with three zones: inside users may browse the internet, the internet may reach only HTTPS on the DMZ web server, inside admins may manage the DMZ, the DMZ may only fetch updates, and the router itself answers only the ICMP it needs from outside.

Interface	Zone	Address
Gi0/0/0	OUTSIDE	203.0.113.2/30, default route to 203.0.113.1
Gi0/0/1	INSIDE	10.10.10.1/24
Gi0/0/2	DMZ	198.51.100.17/28 (public block routed to R1 by the ISP)

R1 already translates the inside subnet to its outside address with PAT. The DMZ uses public addresses, so it needs no NAT. R1 itself uses no internet services in this lab.

Tasks

Create the INSIDE, OUTSIDE and DMZ zones and put each interface in its zone.
Inside to outside, inspect HTTP, HTTPS, DNS and ICMP; drop and log everything else.
Outside to DMZ, inspect only HTTPS to the web server 198.51.100.20.
Inside to DMZ, inspect SSH and HTTPS from the inside subnet for administration.
DMZ to outside, inspect only DNS and HTTPS for updates.
Outside to the router itself, pass only ICMP echo replies, unreachables and time exceeded; drop the rest.

Solution

1ZonesR1

R1 on Cisco IOS

zone security INSIDE
zone security OUTSIDE
zone security DMZ

2Inside to outsideR1

R1 on Cisco IOS

class-map type inspect match-any CM-WEB-DNS
 match protocol https
 match protocol http
 match protocol dns
 match protocol icmp
!
policy-map type inspect PM-IN-TO-OUT
 class type inspect CM-WEB-DNS
  inspect
 class class-default
  drop log

inspect builds a session, so the replies come back without any OUTSIDE to INSIDE policy.

3Outside to DMZ, and inside to DMZR1

R1 on Cisco IOS

ip access-list extended ACL-TO-WEB-SRV
 permit tcp any host 198.51.100.20 eq 443
!
class-map type inspect match-all CM-OUT-TO-WEB
 match access-group name ACL-TO-WEB-SRV
 match protocol https
!
policy-map type inspect PM-OUT-TO-DMZ
 class type inspect CM-OUT-TO-WEB
  inspect
 class class-default
  drop log
!
ip access-list extended ACL-ADMIN-TO-DMZ
 permit tcp 10.10.10.0 0.0.0.255 198.51.100.16 0.0.0.15 eq 22
 permit tcp 10.10.10.0 0.0.0.255 198.51.100.16 0.0.0.15 eq 443
!
class-map type inspect match-all CM-IN-TO-DMZ
 match access-group name ACL-ADMIN-TO-DMZ
!
policy-map type inspect PM-IN-TO-DMZ
 class type inspect CM-IN-TO-DMZ
  inspect
 class class-default
  drop log

match-all with an ACL and a protocol means both must match: the right destination and real HTTPS.

4DMZ to outside, and outside to selfR1

R1 on Cisco IOS

class-map type inspect match-any CM-DMZ-UPDATES
 match protocol dns
 match protocol https
!
policy-map type inspect PM-DMZ-TO-OUT
 class type inspect CM-DMZ-UPDATES
  inspect
 class class-default
  drop log
!
ip access-list extended ACL-OUT-TO-SELF
 permit icmp any any echo-reply
 permit icmp any any unreachable
 permit icmp any any time-exceeded
!
class-map type inspect match-any CM-OUT-TO-SELF
 match access-group name ACL-OUT-TO-SELF
!
policy-map type inspect PM-OUT-TO-SELF
 class type inspect CM-OUT-TO-SELF
  pass
 class class-default
  drop log

pass is stateless and one way, which is fine for ICMP messages coming back to the router. Once the OUTSIDE to self zone-pair exists, only what this policy allows from outside reaches R1, including SSH. If R1 later runs a VPN or a routing protocol with the ISP, add those protocols here first.

5Zone-pairs and interfacesR1

R1 on Cisco IOS

zone-pair security ZP-IN-OUT source INSIDE destination OUTSIDE
 service-policy type inspect PM-IN-TO-OUT
zone-pair security ZP-OUT-DMZ source OUTSIDE destination DMZ
 service-policy type inspect PM-OUT-TO-DMZ
zone-pair security ZP-IN-DMZ source INSIDE destination DMZ
 service-policy type inspect PM-IN-TO-DMZ
zone-pair security ZP-DMZ-OUT source DMZ destination OUTSIDE
 service-policy type inspect PM-DMZ-TO-OUT
zone-pair security ZP-OUT-SELF source OUTSIDE destination self
 service-policy type inspect PM-OUT-TO-SELF
!
interface GigabitEthernet0/0/0
 zone-member security OUTSIDE
interface GigabitEthernet0/0/1
 zone-member security INSIDE
interface GigabitEthernet0/0/2
 zone-member security DMZ

Assign zones last, ideally from the console or with reload in 10 scheduled: the moment an interface joins a zone, traffic between it and unzoned interfaces is dropped. There is no DMZ to INSIDE zone-pair, so the DMZ can never open a connection inward.

Verify

R1 output

R1# show zone-pair security
Zone-pair name ZP-IN-OUT
    Source-Zone INSIDE  Destination-Zone OUTSIDE
    service-policy PM-IN-TO-OUT
Zone-pair name ZP-OUT-DMZ
    Source-Zone OUTSIDE  Destination-Zone DMZ
    service-policy PM-OUT-TO-DMZ
Zone-pair name ZP-IN-DMZ
    Source-Zone INSIDE  Destination-Zone DMZ
    service-policy PM-IN-TO-DMZ
Zone-pair name ZP-DMZ-OUT
    Source-Zone DMZ  Destination-Zone OUTSIDE
    service-policy PM-DMZ-TO-OUT
Zone-pair name ZP-OUT-SELF
    Source-Zone OUTSIDE  Destination-Zone self
    service-policy PM-OUT-TO-SELF

Five zone-pairs, each with its policy, and none from DMZ to INSIDE. Newer IOS-XE releases also print a zone-pair number after the name.

R1 output

R1# show policy-map type inspect zone-pair ZP-IN-OUT sessions
policy exists on zp ZP-IN-OUT
  Zone-pair: ZP-IN-OUT

  Service-policy inspect : PM-IN-TO-OUT

    Class-map: CM-WEB-DNS (match-any)
      Match: protocol https
      Match: protocol http
      Match: protocol dns
      Match: protocol icmp

   Inspect

      Established Sessions
       Session 0x00000012 (10.10.10.51:51544)=>(192.0.2.80:443) https SIS_OPEN

Trimmed. PC1's HTTPS session to 192.0.2.80 is in the session table, which is what lets its replies in. Field layout varies between releases.

R1 output

R1# show logging | include FW-6-DROP_PKT
%FW-6-DROP_PKT: Dropping tcp session 192.0.2.99:52100 198.51.100.20:22 on zone-pair ZP-OUT-DMZ class class-default with ip ident 0

An SSH attempt from the internet to the DMZ server fell into class-default and was dropped and logged, while HTTPS to the same server works.

Mistakes people make

Forgetting a zone on one interface. Traffic between a zoned and an unzoned interface is dropped.
Using pass where inspect was meant, then wondering why replies are dropped in the other direction.
Adding an OUTSIDE to self zone-pair without the protocols the router really uses, which can kill a VPN or BGP session to the ISP.
Leaving OUTSIDE to self unconfigured, which leaves the router itself reachable from the internet on every service it runs.
Applying zones remotely with no rollback plan.

On other platforms

The same intent on a PAN-OS firewall. Interzone traffic is denied and intrazone traffic allowed by default, like ZBF, and rules name applications instead of ports.

PAN-OS

set zone inside network layer3 ethernet1/2
set zone outside network layer3 ethernet1/1
set zone dmz network layer3 ethernet1/3
set rulebase security rules inside-to-internet from inside to outside source 10.10.10.0/24 destination any application [ ssl web-browsing dns ping ] service application-default action allow
set rulebase security rules internet-to-web from outside to dmz source any destination 198.51.100.20 application ssl service application-default action allow
set rulebase security rules admin-to-dmz from inside to dmz source 10.10.10.0/24 destination 198.51.100.16/28 application [ ssh ssl ] service application-default action allow
set rulebase security rules dmz-updates from dmz to outside source 198.51.100.16/28 destination any application [ dns ssl ] service application-default action allow

Say it in the interview

"Zones first, then one zone-pair per direction that needs traffic, each with an inspect policy whose class-default drops and logs. Inspect is stateful, so replies need no reverse policy. There is no DMZ to inside pair at all, and an outside to self policy so the router does not answer the internet on everything it runs. Interfaces go into zones last, with a rollback scheduled."

Book 8.5 Example Systems