How does the Cisco IOS zone-based firewall work?
Show the answer
Say this first
Interfaces are put into security zones. Traffic between two zones is dropped unless a zone-pair, which
has a direction from a source zone to a destination zone, carries a policy. The policy is MQC with
type inspect: class maps pick the traffic, and the action is inspect (stateful, replies allowed
automatically), pass (stateless, one direction only) or drop. Traffic between interfaces in the
same zone flows by default, and traffic to and from the router itself belongs to the built-in self
zone, which is allowed until I configure zone-pairs for it.
Go deeper
Default behavior
| Traffic | Result |
|---|---|
| Between interfaces in the same zone | allowed |
| Between two zones with no zone-pair policy | dropped |
| Between a zoned interface and an interface in no zone | dropped |
| Between two interfaces in no zone | allowed, normal routing |
| To or from the router (self zone) | allowed until a zone-pair with self is configured |
Minimal policy: inside users to the internet
zone security INSIDE
zone security OUTSIDE
!
class-map type inspect match-any CM-WEB-DNS
match protocol https
match protocol http
match protocol dns
match protocol icmp
!
policy-map type inspect PM-IN-TO-OUT
class type inspect CM-WEB-DNS
inspect
class class-default
drop log
!
zone-pair security ZP-IN-OUT source INSIDE destination OUTSIDE
service-policy type inspect PM-IN-TO-OUT
!
interface GigabitEthernet0/0/1
zone-member security INSIDE
interface GigabitEthernet0/0/0
zone-member security OUTSIDENo OUTSIDE to INSIDE zone-pair is needed for the replies: inspect creates the session and the
return packets match it. class-default in an inspect policy drops by default; drop log makes it visible.
ZBF replaced the older CBAC (ip inspect), and the two cannot be used on the same interface.
They will ask next
Why would you configure a zone-pair with the self zone?
To protect the router. For example OUTSIDE to self allows only IKE and ESP for a VPN and ICMP replies, and drops the rest. Once a zone-pair from a zone to self exists, only what its policy allows from that zone reaches the router.
What happens when you add a new subinterface and forget to put it in a zone?
Traffic between it and every zoned interface is dropped. It is a common outage after adding a VLAN to a router running ZBF.
Traps
- Using
passand forgetting that the reply direction needs its own zone-pair andpass. - Expecting traffic between two interfaces in the same zone to be inspected. By default it is not.